What the cPanel Reseller File-Write Update Means for You

On October 26, 2026, cPanel published an advisory for CVE-2026-105476. In plain language, a reseller account on a cPanel & WHM server could direct a root-privileged process to write a file anywhere that reseller chose. Root means the system account. cPanel says a successful attempt can create or overwrite files anywhere on the server as root. If your website, email, or invoices live on a server like that, the version number is worth a calm check this week.

I do this work with owners who want a senior engineer on a set plan. Able Retainer is $799 a month for eight hours of senior production time, planned with you. Email greg@ableadmins.com and we will look at your cPanel version together.

What cPanel reported

The support article is by Devon Courtney. Its title dates the advisory October 26, 2026, and the page shows Updated October 30, 2026. cPanel says the vulnerability allows a user to direct a root-privileged process into writing a file to a location of the reseller's choosing. The advisory lists cPanel & WHM v78 and later as affected. The patched versions are 110.0.154 or later, 134.0.67 or later, 136.0.51 or later, and 138.0.19 or later. cPanel's call to action is to update to the latest patched version.

A reseller login can open other hosting accounts under it. For you, that may be a web partner, a contractor, or a client you trusted with that access. The advisory describes that account steering a root process into writing a file. The full CVE write-up and the package lists are in cPanel's advisory.

The 138 change log dates build 138.0.19 to 2026-10-26. The security line reads "[Security] Security hardening. Reverting to an earlier version removes these improvements." The change log entry does not name CVE-2026-105476. You will see the hardening note there. The advisory is where the reseller file-write behavior is described.

What it means for your company

The useful question is whether the server that holds your site is on a patched build, and who can still log in as a reseller.

On an ordinary shared plan, where you never received a reseller login, your host applies the update. Ask which cPanel & WHM version the server runs, and whether that version is one of the patched builds above. A clear reply includes the number. If the note says you are current, ask for the number so you can keep it on file.

When the server is yours, or you were given reseller access on a VPS or a dedicated machine, the update sits with you. WHM can install it. I take a backup, apply the patched build, and then confirm the site and mail still answer.

A file written as root can land outside the folders you usually open in cPanel. A healthy page in the browser says the site is answering, and the server version is still its own question. Start with the build. Then see who holds reseller access.

Questions worth sending

• Which cPanel & WHM version is the server running today?
• Does that version meet 110.0.154, 134.0.67, 136.0.51, or 138.0.19 on your branch?
• If it is behind, when will the patched build go on?
• Who has reseller access, and do they still need it?
• When was the last full backup taken, and where is it stored?

A version, a date, and a short list of privileged logins will show you where you stand. If the answer comes back muddy, forward it to me and I will translate it.

How to read the version

cPanel maintains more than one current branch, and each branch has its own patched build. Build 138.0.19 belongs to the 138 branch. The change log dates that build to October 26, 2026. On the 110, 134, and 136 branches, the patched versions are 110.0.154, 134.0.67, and 136.0.51 or later. The advisory lists v78 and later as affected, so an older server belongs in the same check.

Reverting to an earlier version removes these improvements. Once the patched build is on, leave it there. A rollback to quiet a plugin removes the hardening too.

Confirm the build, update when the server is behind, and leave reseller access with the people who still do the work. Write the version down so the next check is short.

How Able can help

Able Retainer fits when this server is part of how you do business and you want the upkeep on a calendar. The plan is $799 a month, eight hours of senior production time, planned with you. I use those hours for the cPanel update, a look at reseller accounts, backups, and the next job already on your list. Email greg@ableadmins.com or call (832) 977-1356. Send the version if you have it. If you are still waiting on the host, tell me who they are and I will help you ask.

We choose the hours together. Some months the work is this update. Some months it is mail, PHP, or a deploy you want senior hands on. I do the work and write back in plain English.

Sources

• cPanel 138 change log

If you want this on a monthly plan, I would be glad to start with you on the Able Retainer.