InfoSecBulletin Cybersecurity for mankind
CPanel has put out security updates to fix three problems in cPanel & WHM. These problems could let attackers take over WHM admin sessions or run commands as the root user. Organizations with affected systems should focus on upgrades. These problems impact all supported versions of cPanel & WHM before the new fixed versions.
cPanel & WHM Vulnerabilities
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
The biggest flaw, called CVE-2026-93698, affects the Multilang adminbin part. This weakness happens due to not checking inputs well enough, allowing anyone to run commands through the part.
Successful exploitation can let an attacker run code as the root user, the most powerful account on a Linux server, according to cPanel’s advisory.
The other two flaws, CVE-2026-93029 and CVE-2026-93697, are cross-site scripting (XSS) issues found in WHM admin interfaces. CVE-2026-93029 affects the Manage SSL Hosts interface, while CVE-2026-93697 affects the Mass Modify Accounts interface. Both issues let a regular user save harmful script content that runs when an admin opens the affected interface.
CPanel has fixed all three security issues in cPanel & WHM versions 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11 or newer. WP Squared users need to update to version 11.138.1.13 or newer. The warnings were shared on September 29, 2026.
Administrators must quickly update affected servers to the latest patched version, not only the minimum fixed one. They should also check WHM access logs, special session activity, account changes, SSL host updates, and any unusual command uses for signs of post-exploitation activity.
GitLab
A serious flaw in GitLab’s AI Gateway might allow a logged-in user with Duo Agent Platform access to run commands on the gateway under some conditions, GitLab said in a notice. The gateway connects a GitLab instance to AI models. Only organizations with their own gateway need to take action. The problem is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.
The flaw is called CVE-2026-90970. GitLab made it public on October 2 and said it is critical, giving it a CVSS score of 9.9 out of 10. GitLab has set up AI Gateways for its users and has already made them work well. Users on GitLab.com, GitLab Dedicated, and self-managed systems using a GitLab gateway do not need to do anything, the company noted.
Affected and Fixed Versions
The versions below are AI Gateway versions. The gateway is set up as a separate Docker image or Helm chart and has its own steps for updating.
Gateway version in use First fixed version
18.1.6 or later, before 19.2.4 19.2.4
19.3, before 19.3.2 19.3.2
19.4, before 19.4.1 19.4.1
Dell
Dell has issued security updates to fix several serious flaws in Dell Container Storage Modules (CSM). These flaws could be used by hackers to take control of weak systems.
The vulnerabilities are listed below:
CVE-2026-63688 (CVSS score: 10.0) – The vulnerability allows an attacker to get access to storage backend admin credentials for all registered storage arrays without needing to log in.
CVE-2026-63692 (CVSS score: 10.0) – A vulnerability in the authorization proxy and tenant service lets an attacker on the network gain admin-level access without logging in.
CVE-2026-67269 (CVSS score: 9.9) – A flaw in the ContainerStorageModule Custom Resource reconciler lets a low-level remote attacker gain higher privileges and access root-level control on cluster nodes.
CVE-2026-54472 (CVSS score: 9.8) – A vulnerability due to hard-coded passwords in the CSM Authorization module that allows a remote attacker without authentication to create fake admin tokens and get unauthorized access to the CSM Authorization proxy.
CVE-2026-61421 (CVSS score: 9.8) – A vulnerability in the JWT authentication component of karavi-authorization that allows someone without authorization to use a widely known signing secret to create fake authentication tokens and get admin access.
CVE-2026-67273 (CVSS score: 9.6) – A vulnerability in a template engine that allows a low-level attacker with remote access to gain higher privileges, steal sensitive information, and make unauthorized changes to role-based access controls.
“This vulnerability is considered critical as it enables a complete bypass of the csm-authorization security model, allowing an attacker to gain full administrative control over the storage infrastructure spanning all five supported Dell storage product families,” Dell said about CVE-2026-63688.
