Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Government agencies communicate via .gov.sg websites (e.g. go.gov.sg/open). Trusted websites
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability in cPanel & WHM

5 August 2026

Authenticated attackers can exploit a critical vulnerability in cPanel & WHM to gain database root privileges and potentially compromise other customers hosted on the same server. Patch immediately.

Background

cPanel & WHM is a widely used web hosting control panel for managing Linux web hosting servers. Security updates have been released to address a critical database privilege escalation vulnerability (CVE-2026-58048) affecting supported versions of cPanel & WHM and WP Squared. This vulnerability has a Common Vulnerability Scoring System (CVSS v4.0) score of 9.4 out of 10. 

Impact

Successful exploitation of this privilege escalation vulnerability could allow an authenticated cPanel user to execute SQL statements with database root privileges. In shared hosting environments, this could enable unauthorised access to, or manipulation of databases belonging to other customers hosted on the same server. Depending on the operating system and database configuration, successful exploitation may also lead to operating system compromise.

Affected Products

The vulnerability affects the following products:

  • cPanel & WHM all supported versions prior to 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, and 11.136.0.32

  • WP Squared versions prior to 138.1.6

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

If immediate patching is not possible, temporarily restrict MySQL features for cPanel users as recommended by the vendor until updates can be applied. Review system and database logs for signs of suspicious or unauthorised activity. 

Customers using managed or shared web hosting services should verify with their hosting provider that the affected systems have been updated.

References

Back to top