cPanel and WHM: update tiers and keeping servers patched

Updated November 2026

cPanel & WHM can update itself every night and apply security builds every hour, but only if those settings are on and your server runs a supported version. Check your build, confirm /etc/cpupdate.conf, keep operating system updates on, and keep WHM (port 2087) closed to everyone except your admin addresses.

What cPanel and WHM are

cPanel & WHM is a commercial hosting control panel used by web hosts and many self-managed servers. WHM (WebHost Manager) is the root and reseller interface, served on port 2087 over HTTPS. cPanel is the per-account interface for website owners, on port 2083. Webmail runs on 2096. The plain-HTTP ports 2082, 2086 and 2095 also exist; the cPanel documentation strongly recommends using only the SSL versions.

Because WHM runs as root and manages every site, mailbox and database on the server, a flaw in its login code is a full server compromise. In April 2026 an authentication bypass (CVE-2026-41940) was exploited before most servers were patched, which is why update settings and port restrictions both matter.

Check your version

Run these as root (or with sudo):

/usr/local/cpanel/cpanel -V        # e.g. 134.0 (build 57)
cat /usr/local/cpanel/version      # e.g. 11.134.0.57
whmapi1 version                    # same, through the WHM API
grep -E '^(CPANEL|UPDATES|RPMUP|SECURITY_UPDATES)=' /etc/cpupdate.conf

Security advisories quote fixed builds in the long form (for example 11.134.0.57), which is what /usr/local/cpanel/version prints. Compare the last number, the build, against the advisory for your major version.

Release tiers and supported versions

Each server follows a release tier, set as CPANEL= in /etc/cpupdate.conf or as “Release Tier” in WHM’s Update Preferences:

LTS

One major version per year, kept for about a year with security and critical fixes only. Servers on LTS move to the next LTS version when it appears.

STABLE

A version that has had public exposure and testing; published less often than RELEASE.

RELEASE

The default for new installations: feature-complete and tested. Automatic major-version upgrades on this tier may be delayed by a few random business days to spread the load.

CURRENT

A release candidate; tested, but some features may still be in development.

EDGE

Rudimentary testing only, updated up to several times a week. cPanel says not to use it on production servers.

A non-LTS version does not reach end of life until the next version reaches the RELEASE tier, so the dates above can move. Once a version reaches end of life it gets no more security fixes, and cPanel emails a warning beforehand. Supported operating systems are AlmaLinux (8, 9 and 10), CloudLinux, Rocky Linux and Ubuntu 24.04 LTS. When cPanel adds a new Ubuntu LTS, the older one is deprecated and blocks upgrades to newer cPanel versions. If you are on CentOS 7, you are limited to version 110; see what to do on an end-of-life server.

Update settings in /etc/cpupdate.conf

These are the documented defaults:

CPANEL=release
RPMUP=daily
SARULESUP=daily
SECURITY_UPDATES=hourly
STAGING_DIR=/usr/local/cpanel
UPDATES=daily

• UPDATES (daily, manual, never): automatic cPanel & WHM updates within your tier. cPanel says it does not recommend never.
• SECURITY_UPDATES (hourly, never): an hourly cron job runs upcp --security and applies security builds for your current major version. It runs even if version or package updates are set to manual.
• RPMUP (daily, manual, never): operating system package updates during the nightly update.
• CPANEL: a tier name, or a fixed version such as 134. Pinning a version stops automatic major upgrades, so you must move it yourself before that version’s end of life.

It is safer to change these in WHM » Server Configuration » Update Preferences than to edit the file. Missing or invalid values are reset to the defaults.

Update now with upcp

As root:

# update to the newest build allowed by your tier
/usr/local/cpanel/scripts/upcp

# only critical security updates for the current major version
/usr/local/cpanel/scripts/upcp --security

# run in the background and follow the log
/usr/local/cpanel/scripts/upcp --bg
tail -f "/var/cpanel/updatelogs/$(ls -t /var/cpanel/updatelogs/ | head -1)"

Two other options exist for repairs: --sync repairs the installed version without downloading a newer one, and --force reinstalls all files. The cPanel documentation warns that --force overrides your update preferences, so check your tier first; the two cannot be combined. When the update finishes, run /usr/local/cpanel/cpanel -V again and compare the build with the advisory.

Operating system updates under cPanel

cPanel manages its own software, but the kernel, OpenSSL, glibc and other system packages come from the operating system. With RPMUP=daily the nightly update installs them. If it is manual or never, update them yourself:

sudo dnf upgrade --refresh                 # AlmaLinux, Rocky, CloudLinux
sudo apt update && sudo apt upgrade        # Ubuntu 24.04

A kernel update needs a reboot (this restarts every site and service on the server). Check whether one is pending with sudo dnf needs-restarting -r or by looking for /var/run/reboot-required on Ubuntu. See Kernel updates and Kernel live patching for options that reduce reboots.

Recent security releases

For CVE-2026-41940, cPanel also published a script to scan session files for signs of exploitation. Any server that was unpatched in late April 2026 should be checked with it, and with Signs of compromise. More issues are listed on the vulnerability list.

Restrict panel ports to admin IPs

Website owners on a shared server need cPanel (2083) and webmail (2096). WHM (2087, and 2086 if still open) is for administrators and resellers only, so it is the first port to restrict to your office addresses or VPN. The Canadian Cyber Centre’s advice for CVE-2026-41940 was exactly this: allowlist the IPs that may reach the cPanel/WHM interfaces until the patch is in.

• WHM » Security Center » Host Access Control lets you accept or drop access per service (whostmgrd for WHM, cpaneld, webmaild, sshd and others). On AlmaLinux, Rocky and CloudLinux the rules are nftables rules by port; on Ubuntu they go into /etc/hosts.allow and /etc/hosts.deny. Put ACCEPT (or allow) rules for your addresses before the DROP rule.
• Single IPs and CIDR ranges such as 203.0.113.0/24 work. On Ubuntu, IPv6 addresses go in square brackets.
• If you lock yourself out, fix it from the console: edit the nft rules (AlmaLinux, Rocky, CloudLinux) or /etc/hosts.allow (Ubuntu).
• At least one of ports 2082, 2083, 2086, 2087 or 2096 must stay reachable for cPanel’s license callback.

The firewall guide covers general rules; restrict SSH the same way.

Turn on two-factor authentication

In WHM » Security Center » Two-Factor Authentication, set the policy to On, then set up 2FA for root under “Manage My Account” with any TOTP app (cPanel mentions Google Authenticator and Duo Mobile). Resellers and cPanel users then enroll in their own interfaces. To require 2FA for API calls too, enable “API requests” in WHM » Security Center » Configure Security Policies; some third-party tools may break. If codes are rejected, check that the server clock is correct.

Where advisories are published

• cPanel’s Security section on support.cpanel.net, where each advisory lists the fixed builds.
• The cPanel blog security category and the version change logs.
• National CERTs, such as the Canadian Centre for Cyber Security, repeat the fixed versions in plain form. See Security advisories.

Quick hardening tips

• Keep UPDATES=daily and SECURITY_UPDATES=hourly unless you have a tested manual process.
• Use LTS, STABLE or RELEASE on production; keep EDGE and CURRENT for test servers.
• Restrict WHM (2087) and SSH to admin IPs or a VPN with Host Access Control or the firewall.
• Turn on 2FA for root and every reseller.
• Close the non-SSL ports 2082, 2086 and 2095 if nothing needs them.
• Check the update log in /var/cpanel/updatelogs after each big advisory instead of assuming it worked.
• Plan the move off an end-of-life OS or cPanel version months before the date.

Sources

• Product versions and the release process, cPanel documentation
• The cPanel update configuration file (cpupdate.conf), cPanel documentation
• Update Preferences, cPanel documentation
• The upcp script, cPanel documentation
• Return cPanel & WHM version (WHM API 1), cPanel
• System requirements, cPanel documentation
• AlmaLinux requirements, cPanel documentation
• Ubuntu requirements, cPanel documentation
• How to configure your firewall for cPanel services, cPanel documentation
• Host Access Control, cPanel documentation
• Two-Factor Authentication for WHM, cPanel documentation
• Security update: CVE-2026-41940, cPanel blog
• AL26-008: Vulnerability affecting cPanel and WHM, Canadian Centre for Cyber Security
• cPanel security advisory AV26-861, Canadian Centre for Cyber Security
• WebPros security advisory AV26-961, Canadian Centre for Cyber Security