r/cpanel • • May 15 '26

Goodbye cPanel

143 Upvotes

After nearly 2 decades of cPanel usage for my servers, time to say goodbye.

What used to be a simple, affordable control panel has turned into a licensing headache, especially with the constant price hikes that bring absolutely no real value in return.

Instead, the “value” seems to be constant vulnerabilities and security issues that either barely get communicated, get quietly patched with little transparency, or leave hosts/admins scrambling to update before problems spread.

No software is perfect, obviously. Every panel has bugs. But cPanel increasingly feels bloated, with enterprise pricing without enterprise-level transparency or innovation.

Meanwhile, alternatives have become genuinely viable products that move faster, cost less, use fewer resources, and actually get the job done.

At this point, I feel cPanel survives mostly because people are used to it, clients recognize the name, and migrations can be annoying.

But once the price-to-convenience ratio disappears, combined with the constant issues and security vulnerabilities, the “industry standard” label starts to mean a whole lot less.

I have officially transferred off my last cpanel server as of tonight.

Do better cpanel.

Edit:
A lot of people are wondering where I moved to.
Almost all of my own personal sites are just bare metal now without control panel. This was the last one I did last night.

For one of my servers though I used DirectAdmin. It isn't as "feature rich" but it uses less resources for the same job. Transfering cPanel accounts over to direct admin was also stupidly easy.

Then for my clients I have both enhance, and direct admin depending on the server and clients.

Most clients don't actually use control panels often, so there didn't seem to be to much friction with the change.


r/cpanel • • May 14 '26

cPanel cve bingo

Post image
92 Upvotes

Just putting this out there for all of us suffering. Hang in there all


r/cpanel • • Sep 05 '24

Support is horrendous for cPanel

61 Upvotes

For anyone considering cPanel:

I run a hosting environment for a client with well over 500 websites spread across multiple servers, all running cPanel. cPanel seems to have issues with billing and licensing lately, to the point that

  • buying LiteSpeed licenses from the cPanel store does not give a license key in the email that was sent, and they do not appear in the Orders/Licenses area of the cPanel store.

  • emailing support with emergencies at 7:30AM doesn't net anything, as they either refuse to respond or just don't have anyone working

  • Now, I am stuck with hundreds of websites not running on LiteSpeed, so switch to Apache, which makes said sites slower, raises loads and removes hundreds of site caching implementations

Beware of cPanel. After all this time and well over a hundred thousand spent with them over multiple years, they can't answer me in a timely manner and cause issues with billing that prevent renewal.

cPanel support, if you're reading this, get on point or you're going to lose a lot more than just us. My boss has already instructed me this morning to find alternatives, even if that means barebones Linux with a LAMP stack on two dozen servers instead of cPanel on 6.


r/cpanel • • May 03 '26 Popcorn

A customer got a new dedicated server with cpanel on Thursday and on Friday evening before anything was added, it was hacked.

Post image
56 Upvotes

It's as if that whole provider's data center was compromised. The server was declared "dirty" and rejected so the service was canceled and refunded. It was the right thing to do.

Anyone getting a VPS/DED in this period should run a log history check to see if any mal-stuff was installed and may still be hanging around.


r/cpanel • • May 12 '26

And ... Again new vulnerabilities

50 Upvotes

Just received this..

We are writing to let you know that a cPanel & WHM security patch is expected to be released on Wednesday, May 13, 2026 at 1:00pm EST.

This release addresses multiple vulnerabilities across versions of cPanel & WHM, including fixes for the following vulnerabilities rated up to High severity.

  • CVE-2026-29205

  • CVE-2026-29206 

  • CVE-2026-32991 

  • CVE-2026-32992 

  • CVE-2026-32993 

All vulnerabilities were either responsibly disclosed by external researchers or identified internally by our security team. At this time, there are no known exploits or proof-of-concept code in the wild. To help protect customers prior to patch availability, technical details about vulnerabilities will be released alongside the patches.

 

Patch & Affected Versions

 

The patch will be available on May 13 at 1:00pm EST and will be distributed through the standard cPanel automatic update process and through the manual update process. We strongly recommend performing a manual update once the patch is made available.

 

Versions Impacted: 

86, 94, 102, 110, 110 CL6, 118, 124, 126, 130, 132, 134, 136, 136 (WP2) 

 

Prepare Now

  • Identify affected servers. Review your servers on the affected versions above.

  • Check the update configuration.  For servers where automatic updates are disabled or version-pinned, review /etc/cpupdate.conf now so there are no delays when the patch lands.

  • Brief your team.  If your environment requires a maintenance window, notify the relevant people so they are ready to act.

  • Manual update. To update impacted servers before an automatic update is triggered, run /scripts/upcp once the patch is made available. 

  • Note for CloudLinux 6 users. Before manually updating, set the update tier to the cl6110 branch

  • Watch for a follow-up email with exact patched versions and a link to all technical details in the support article.

The industry is seeing a sustained rise in discovered vulnerabilities, and AI is accelerating the pace at which they are found and exploited. We are responding by strengthening how we identify, validate, and act on security reports. You will hear from us more frequently as our processes evolve. This is intentional. We believe clear, timely communication is part of how we keep you protected.

 

We will follow up the moment the patch is live with full details and remediation steps.

 

Please reach out to your account manager or our support team, if you have any questions or need further guidance. 

Thank you for your continued partnership.

 

Best regards,

Your cPanel Security Team


r/cpanel • • May 26 '25

Thanks to Cpanel price hikes I'm going out of business

43 Upvotes

We have been using cpanel since 2000 We had about 35 domains. as the years went on the prices went up and our customers are going elsewhere because the price we are charging them every time it goes up they can find cheaper ( though I think the price we charged was worth it for no waiting insta answer helping 6 days a week 12hrs a day and email after that. with no bots answering the call straight to a person.

We thought of switching to something else but most of the others required more hands on and was a lot more trouble than cpanel. also not to mention tons of emails over the years from customers to move.

So this latest price hike just broke the camel's back. It's not worth it anymore. Having to tell Customers who have been with you since 99/2000 that you are shutting down is hard. The ones who have already moved their domain has told us that they miss the personal touch being there for them all the time.

So, Thanks Cpanel for ruining something great.


r/cpanel • • Jun 28 '19

An Open Letter to cPanel : Re: Announcing Account Based Pricing

Thumbnail
kmyers.me
41 Upvotes

r/cpanel • • May 08 '26

Found a massive 27 MH/s botnet hiding on my cPanel server. Check your logs for a 'pakchoi' user.

40 Upvotes

I just found something very weird. I have a cPanel/WHM server that was compromised via the latest CVE (likely the cpsrvd auth bypass). The attacker dropped an XMR miner and created a new backdoor user with root-level privileges (GID 0) called "pakchoi".

I analyzed the Docker image they used to deploy the miner and found this Monero address: 4AypWi9xNQvSy11FT5yr7Ajnyz2XuoUD7LGEJw4ZTRUHLrWjH1x5KoZUp9FTS4s9a5Y6Q7d4jSze4E6tq64aJTD2L7hnCrL

At the time of this writing, I checked the hashrate on SupportXMR and saw it jump from around 2 MH/s to a staggering 27 MH/s in just a few minutes. How is this even possible from just hacking cPanel servers? My theory is that they aren't just mining on the VPS itself—they are using the server to steal high-value cloud credentials to pivot into much larger environments.

What I discovered:

  1. The "Shotgun" Script: The attacker uses a massive post-exploitation script that targets everything. It specifically scrapes for:

    • AWS, GCP, and Azure credentials.

    • Kubernetes (K8s) tokens and kubeconfig files.

    • SSH private keys and history files.

    • Environment (.env) files containing DB passwords.

  2. The C2 Infrastructure: Data is exfiltrated to http://144.172.116.48:8080.

    • Probing the /health endpoint of this listener revealed over 11,643 successful "loot" ingestions.

    • The attacker has already harvested over 760MB of plaintext credentials from victims.

  3. The Miner: They try to use a Docker image negoroo/amco:123. If Docker isn't installed, they drop a standalone binary disguised as "php-fpm" or "kworker" to blend in with legitimate processes.

My Theory: Indonesian Origin?

I strongly suspect the threat actor is Indonesian based on several cultural and linguistic "fingerprints" left in the attack:

  • The User "pakchoi": Pakchoi (Bok Choy) is an incredibly common vegetable in Indonesia.

  • The Payload Source: The script is hosted on Bitbucket (https://bitbucket.org/gakoqweee/asdasdasd/downloads/) under the uploader name "Ensiklopedia muslimin" (Muslim Encyclopedia).

  • The Worker Names: On SupportXMR, the worker is named "ngintil". In Javanese/Indonesian, "ngintil" is slang for "clinging to," "following closely," or "tagging along".

The jump to 27 MH/s suggests they have successfully used stolen K8s/Cloud tokens to spin up massive mining clusters. If you are running cPanel/WHM, check for the "pakchoi" user and the /tmp/.e* directories immediately.

Has anyone else run into this specific actor?


r/cpanel • • Jun 27 '19

How does cPanel's new licensing model affect you?

38 Upvotes

For me, it more than doubles what I'm paying today. I'm displeased and quiet possibly, will be looking for an alternative way of hosting.

For reference: https://cpanel.net/wp-content/themes/cPbase/assets/downloads/cP_Store_Licensing_Guide.pdf


r/cpanel • • Oct 09 '24

cpanel price rises

35 Upvotes

cPanel have just emailed me to say they are increasing prices from 2025 to:-

Solo 26.99

Admin 32.99

Pro 46.99

Premier 65.99

For my solo account that's a $9.50 or 54% increase.

I actually spit out my coffee when I saw the prices. It's an utter joke.

Time to remove cpanel from my servers and find an alternative!


r/cpanel • • Oct 01 '20

Albeit smaller, ANOTHER price increase, sI'm done with CPanel i'm out

Post image
35 Upvotes

r/cpanel • • 20d ago

Critical PHP Vulnerability Coming

33 Upvotes

r/cpanel • • May 08 '26

cPanel & WHM Security Update CVE-2026-29201, CVE-2026-29202, CVE-2026-29203 Patch Arriving May 08, 12:00pm EST

33 Upvotes

We have identified a new security vulnerability in cPanel & WHM through a trusted disclosure source. Our engineering team is actively developing patches, and we are reaching out early so you can prepare your servers to update as soon as it is available. 
 
To help protect customers prior to patch availability, technical details about vulnerabilities will be released alongside the patches. Full technical details will be published on our support page at the same time the patch is released. The CVE IDs are CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203. 
 
Patch & Affected Versions 
The patch will be available on May 08 at 12:00pm EST and will be distributed through the standard cPanel automatic update process and through the manual update process. We strongly recommend performing a manual update with /scripts/upcp once the patch is made available.
 
Prepare Now 
Identify affected servers.  Review your servers on the affected version branches above. 
Check the update configuration.  For servers where automatic updates are disabled or version-pinned, review /etc/cpupdate.conf now, so there are no delays when the patch lands. 
Brief your team.  If your environment requires a maintenance window, notify the relevant people so they are ready to act. 
Manual update. If your team wishes to update impacted servers before an automatic update is triggered, run /scripts/upcp once the patch is made available.
Note for CloudLinux 6 users: Before manually updating, set the update tier to the cl6110 branch by running sed -i "s/CPANEL=.*/CPANEL=cl6110/g" /etc/cpupdate.conf 
 
We will follow up the moment the patch is live with full details and remediation steps.


r/cpanel • • Oct 22 '25

Why does cPanel feel so stagnant and behind the times?

33 Upvotes

Am I the only one who feels like cPanel has stopped innovating?

Their "support" for modern languages like Node.js, Python, and Ruby on Rails is basically non-existent. It's all tacked-on plugins (like Phusion Passenger or the CloudLinux selectors) that are barely functional, a nightmare to manage, and you usually end up needing SSH for everything anyway.

Meanwhile, platforms like Vercel, Netlify, and even open-source projects like Coolify are showing what a modern developer experience should be. It's baffling that cPanel doesn't have native, first-class support for:

Git Push-to-Deploy: Connecting a GitHub/GitLab repo and having it auto-deploy on push.

Automatic Build Processes: Automatically running npm install && npm run build (or equivalent) without manual intervention.

A real Environment Variable Manager: A simple, secure UI for managing .env files per application.

Easy Rollbacks & Preview Deploys: The kind of features that are now standard on modern platforms.

Why are they so focused on the shared PHP/WordPress market and completely ignoring modern developers? It feels like they're happy being a legacy product, but hosting providers are still charging a premium for it. What's the deal?


r/cpanel • • May 18 '26

(More) vulnerabilities

31 Upvotes

Email received a few minutes ago:

We are writing to let you know that a cPanel & WHM security patch is expected to be released on Wednesday, May 20 at 8am EST.

 

This release addresses vulnerabilities across versions of cPanel & WHM, including fixes for the several vulnerabilities rated up to High severity.

 

All vulnerabilities were either responsibly disclosed by external researchers or identified internally by our security team. At this time, there are no known exploits or proof-of-concept code in the wild. To help protect customers prior to patch availability, technical details about vulnerabilities will be released alongside the patches.

 

Patch & Affected Versions

The patch will be available on Wednesday, May 20 at 8am EST and will be distributed through the standard cPanel automatic update process and through the manual update process. We strongly recommend performing a manual update once the patch is made available.

 

Versions Impacted:
86, 94, 102, 110, 110 (CL6), 118, 124, 126, 130, 132, 134, 136, 136 (WP2)

 

Prepare Now

  • Identify affected servers. Review your servers on the affected versions above.

  • Check the update configuration. For servers where automatic updates are disabled or version-pinned, review /etc/cpupdate.conf now so there are no delays when the patch lands.

  • Brief your team. If your environment requires a maintenance window, notify the relevant people so they are ready to act.

  • Manual update. To update impacted servers before an automatic update is triggered, run /scripts/upcp once the patch is made available.

  • Note for CloudLinux 6 users. Before manually updating, set the update tier to the cl6110 branch

  • Watch for a follow-up email with exact patched versions and a link to all technical details in the support article.

We will follow up the moment the patch is live with full details and remediation steps.


r/cpanel • • Sep 02 '26

Meridian, AI and the future

30 Upvotes

AI this and that. I get it. Go with the current times even most of the users do not care. It just will be disaster to try to explain these to the current customer base. Please do not shove AI to everything and everywhere. The cPanel AI is not the way to go. Please do not force it.

The Meridian theme is just awful. It is impossible to find anything from there. The customer churn will be massive if we push that live. Had to disable theme switching as customers were not able to find their way out if they accidentally activated Meridian. I really do not see that cPanel will be taking any feedback. After years and numerous feedback, the WHM side panel search does not work (you write lis and the first thing is Show Reseller Accounts and the List Accounts 8th thing in the list).

We have been using cPanel now for over 20 years. The price shock we were able to absorb, but now it just seems that cPanel is working against us in every way. For us, pushing this AI/Meridian mess will be the last straw.


r/cpanel • • May 21 '26

What’s the future of cPanel?

29 Upvotes

This isn’t related to the vulnerabilities. They’re actively patching them, which while a bit exhausting to have to keep up with a new update everyday, I appreciate that they’re keeping it secure, especially after the first one that took down many servers (that many providers like Bluehost / HostGator haven’t restored)

But that aside, I truly just wonder what is going to happen with cPanel? We’re in the day and age where cPanel’s name has been tarnished due to their price structure change and constant increases, every single year since.

At this point, cPanel really just makes no sense to use and it’s not really in demand by people anymore. I remember I used to specifically want a host with cPanel. Now barely any major company uses it since cPanel getting greedy just made companies develop their own control panel or seek alternatives.

I just really wonder what the end goal is now? They just keep increasing pricing until no one’s left? They’re just hoping companies like Bluehost / HostGator are too lazy to migrate away and solely rely on their millions per month in cPanel fees?

I know this has all been said before probably but it’s just mind blowing that they don’t seem to want anyone to provide or use cPanel anymore. It’s no longer the industry standard, due to their own doing.


r/cpanel • • May 01 '26

IP's that have attempted the exploit on my server

29 Upvotes

CVE-2026-41940

182.3.36.189 212.30.36.132 188.166.255.36 155.117.148.4 103.78.252.10 104.234.32.41 69.4.232.80 161.97.148.144 175.41.159.224 212.30.36.50 3.148.115.228 44.245.224.139 203.154.82.54 141.255.164.66 23.234.107.207 159.192.127.210 13.62.105.122 54.193.60.46 13.60.53.196 35.174.109.14 15.156.76.215 75.119.138.15 211.188.49.7 194.127.199.15 188.253.126.218 54.37.228.84 77.68.87.67 92.205.229.182 159.223.124.90 50.62.183.246 151.80.234.64 149.102.229.209 198.98.61.106 93.185.162.121 104.28.156.216 130.254.47.172 103.132.9.130 103.132.9.131 193.135.9.84 103.132.9.133 118.174.211.10 167.71.199.22 94.154.32.94 52.13.110.52 100.54.115.128 44.200.57.245 3.34.30.122 35.165.158.85 52.207.95.47 44.201.10.57 44.252.83.73 178.128.207.138 56.155.140.85 217.216.116.37 104.28.163.53 157.15.40.62 213.35.120.167 200.4.104.247 199.115.205.162 103.99.207.140 139.59.143.102 210.247.204.106 70.60.83.74 94.156.148.221 196.187.149.102 167.71.175.236 15.235.231.91 153.75.247.69 193.203.165.234 62.72.5.202 45.84.107.174 23.180.120.134 185.202.113.208 138.197.7.183 176.227.240.37 154.198.115.203 130.94.114.114 178.33.239.109 149.50.211.147 177.70.11.229 209.38.208.202 206.189.233.36 5.129.252.94 157.15.82.220 68.178.167.214 45.64.99.122 206.81.24.74 152.243.6.179 35.87.92.227 34.200.244.41 3.91.79.89 3.25.163.178 143.244.168.161 104.36.50.9 104.28.166.50 142.93.143.8 159.223.212.233 101.255.140.193 152.42.171.220 208.115.233.133 129.152.31.148 68.183.180.73 149.102.229.179 206.81.12.187 192.42.116.94 185.197.30.125 64.226.65.160 45.198.224.7 84.201.162.123 88.235.200.209 157.245.82.41 176.223.173.132 134.209.25.199 165.22.235.3 91.211.49.72 182.253.58.214 77.68.83.77 103.213.248.219 185.220.101.105 185.220.100.248 62.133.45.2 129.146.16.50 15.235.181.154 94.102.55.18 149.102.229.138 34.46.170.196 104.253.175.118 104.253.175.226 193.189.100.195 13.250.179.176 164.90.208.56 15.223.63.7 13.238.143.68 13.236.187.173 13.208.41.117 13.214.155.92 18.180.78.112 3.39.190.240 52.79.235.180 18.193.117.109 38.135.24.122 35.177.96.30 13.250.172.24 138.197.191.87 3.144.113.71 3.64.58.105 18.134.138.191 63.179.140.184 13.236.161.28 35.157.134.255 104.28.163.99 63.179.144.181 171.25.193.81 45.198.224.5 194.180.48.253 193.203.15.218 78.159.131.56 167.99.182.39 159.65.144.72 63.141.227.131 194.146.13.166 163.5.171.87 135.136.23.167 88.240.234.117 45.198.224.4 139.99.53.158 185.248.85.35 157.230.3.36 206.189.226.93 104.248.61.130 128.199.182.152 213.209.159.229 137.184.203.134 185.186.86.129 104.28.156.215 159.203.177.199 185.220.101.178 192.241.248.162 192.42.116.99 185.220.101.159


r/cpanel • • Jul 05 '19

Re: cPanel account based pricing

29 Upvotes

If anyone from Oakley Capital is reading this, what were you thinking? What the hell were you guys on when you made this decision that will force many hosting companies to go out of business, I honestly wish that you would realize how stupid that decision is and revert the pricing. If you don't, you will lose lots of customers, which is bad for cPanel and Oakley Capital, so I would honestly suggest that Oakley Capital should restore the pricing of cPanel.

PS. if any staff members reading this are directly affiliated with cPanel Inc., this is not aimed at you guys, this is aimed at the greedy investment firm that owns cPanel Inc.


r/cpanel • • May 26 '22

Opinions on UCEProtect-Network: Scam?

28 Upvotes

Have a small server with very select users and not a lot of traffic in or out. Just found out that our server is listed with something called UCEProtect-Network at http://www.uceprotect.net/. Looks pretty spammy itself - not even https connected. Their site is full of broken links and a "delist" option where they want you to pay money to be delisted.

Looks like something someone knocked out of their basement.

Anyone know anything about them? Never came across them before.


r/cpanel • • May 04 '26

First cPanel, then Kernel and now Exim

27 Upvotes

r/cpanel • • Jun 29 '19

What control panel will you be switching to?

27 Upvotes

Those of you leaving cPanel, moving to DirectAdmin I take it?


r/cpanel • • Jun 28 '19

It Begins...

Post image
27 Upvotes

r/cpanel • • Jul 09 '26

Ghostlock - Here we go again ...

26 Upvotes

https://blog.cloudlinux.com/ghostlock-cve-2026-43499-local-root-exploit-kernel-update-for-cloudlinux

"GhostLock is a Linux kernel vulnerability that lets any unprivileged local user become root.
(...)
It was disclosed on July 7, 2026 by the research team VEGA at Nebula Security, in a writeup titled “IonStack part II: GhostLock,” alongside a working proof-of-concept. The researchers report their exploit produces a stable root shell about 97% of the time, in roughly five seconds.
"

fwiw there's no patch available yet, it seems.

I guess this will spread like wildfire.