cPanel patches root-level domain parking flaw; Plesk fixes three customer-account vulnerabilities
My Take
What happened cPanel patched a vulnerability in domain parking that allowed a customer account with domain permissions to escalate to full server root access.
Why it matters to hosts Domain parking is a routine shared hosting feature, and if your customers can weaponize it to take over your entire server, every account on that box is at risk—and your business model with it.
What to do Verify you have deployed cPanel's August 27 advisory patch across your fleet; audit access logs for any customer accounts with domain permissions to look for unusual activity in the window before patching.
My view This is a reminder that shared hosting's most mundane features can hide serious escalation paths. The fact that Plesk also shipped three customer-account vulnerabilities in the same week suggests hosting providers need to treat permission boundaries as aggressively as they treat kernel exploits.
After patching, how many of your customers actually need domain parking permissions, and should you be reducing that surface by default?
Key Themes
Notable Players
Patched a critical vulnerability in domain parking that allowed customers to escalate to root access; advisory published August 27.
Released patches for three vulnerabilities, each exploitable from ordinary customer accounts; advisories published August 25.
Announced $96B Q2 FY2027 revenue and $160B in memory commitments; expects Vera Rubin to account for 20% of data center revenue in Q3, its fastest hardware ramp ever.
Optimized 1.1.1.1 DNS cache by shrinking entry size, freeing 100TB of RAM globally without adding hardware.
Deployed Monarx ThreatShield inside the PHP engine across its fleet to strengthen runtime security.
Top Stories
A shared hosting customer with domain permissions could exploit a cPanel vulnerability to gain root access to the entire server. Patch immediately if you manage cPanel servers with multiple customer accounts.
Plesk released three security advisories (August 25) for vulnerabilities that begin with standard customer-level access. Deploy these patches urgently across your Plesk fleet.
Nvidia's Q2 FY2027 revenue hit $96B with $160B in new memory commitments, signaling explosive AI demand that will shape data center infrastructure investment for years ahead.
The popular WordPress SEO plugin Rank Math faces accusations of silently granting its makers administrator-level access to customer sites. WordPress hosting providers should audit their Rank Math installations immediately.
Plesk released version 18.0.80 with Model Context Protocol support for AI-assisted management and improved DNS diagnostics. Update your Plesk servers to gain these operational improvements.
Security & Compliance
InMotion deployed Monarx ThreatShield runtime protection inside PHP across its managed hosting fleet. The move signals a shift toward in-process security controls for WordPress and PHP application hosting.
Cloud & Infrastructure
Cloudflare optimized its recursive resolver by reducing DNS cache entry overhead, freeing 100TB of RAM globally. The optimization demonstrates how fine-tuning at massive scale can improve efficiency without hardware replacement.
DigitalOcean launched v5 Droplets on 5th Gen AMD EPYC processors, targeting demanding workloads with higher per-core performance. This refresh cycle underscores cloud providers' competitive pressure to match hyperscaler hardware upgrades.
DigitalOcean deployed patches for two critical virtualization flaws (Januscape CVE-2026-53359 and AMD Safe RET) across its entire fleet with no customer downtime. Their engineering approach offers a model for managing emergency security patching at scale.
Control Panels
Hostinger unified its site builders into a single AI Builder platform that exports generated code but keeps the database on its servers. This hybrid model gives customers portability for code while retaining lock-in on infrastructure.
Acquisitions & Market
GoDaddy faces a securities fraud lawsuit alleging that a .com domain promotion generated far more sales than expected, misleading investors on future demand. The case highlights regulatory risk in aggressive promotional pricing.
Technology & Tools
As AI rack power density exceeds 100 kW, three liquid cooling architectures—RDHx, direct-to-chip, and immersion—offer different operational and cost trade-offs. Understanding these options is essential for any facility planning high-density GPU deployments.
Ubuntu 26.04.1 (Resolute Racoon) is coming, offering an incremental update for users on the LTS track. Plan your server OS refresh cycle around this release.
Linux celebrated 35 years since Linus Torvalds' original announcement, growing from 10,000 lines to 40 million and underpinning the vast majority of hosting infrastructure globally. A landmark moment for the operating system that runs web hosting.
Web Hosting
Namecheap experienced its second major hosting outage in August, affecting 78 shared servers on August 26. Two outages in one month raises questions about infrastructure resilience and customer migration risk.
Other News
Electrical engineering and resilience planning—not chip counts—are setting the upper limits on AI rack density as power and cooling constraints become the binding constraint. Plan infrastructure around power delivery, not just GPU capacity.
The Department of Energy declined three proposed transmission corridors despite citing data center load growth in its analysis. The decision raises questions about whether utilities are building grid capacity fast enough to support AI infrastructure growth.
SK hynix broke ground on the first U.S. HBM plant, with production expected to begin in 2029. Onshoring GPU memory production will reduce supply chain fragility for AI infrastructure.
SpaceX began manufacturing turbine blades in-house to accelerate gas generator delivery for AI data centers, cutting 18-month delays from supply chain bottlenecks. The move illustrates how data center power constraints are forcing companies to vertically integrate.
The Microsoft-backed DataOne facility in Vineland, New Jersey, faces community complaints over unpermitted gas turbines, illegal construction, and noise pollution. Hyperscaler data center projects are encountering increased local resistance.
Nvidia's $89B data center quarter and AWS's plan for two million additional GPUs show AI infrastructure demand broadening beyond hyperscalers. Independent and regional operators will face growing competition for power and bandwidth.
Nvidia projects Vera Rubin sales of $20B in Q3 FY2027, reaching 20% of total data center revenue. The fastest hardware ramp in company history signals explosive demand for next-generation AI infrastructure.
Indiana's I&M utility proposes a $59M rate cut, citing increased revenue from large data center customers offsetting residential load. Data center growth is reshaping utility economics in regions with aging infrastructure.
PJM's accelerated capacity procurement is addressing a 6.8 GW shortfall driven partly by data center load growth. The process underscores regional grid constraints limiting new data center buildout.
The Department of Energy extended the 760 MW Eddystone coal plant's operation as PJM faces rising data center load and delayed power resources. Legacy generation is being kept online longer due to AI infrastructure growth.
OpenAI elevated energy technology planning into its data center organization, signaling that power strategy is now core to infrastructure operations. AI providers are treating energy as a primary competitive constraint.
Lancium announced 4 GW under lease and 15+ GW of powered land through partnerships including Nvidia. Grid-responsive, privately powered data center models are gaining traction as alternatives to traditional utility-dependent facilities.
Data center construction is booming in 2026, but power, labor, and community friction demand innovation and coordination. Buildouts are succeeding where developers invest in relationships and technical discipline.
Prometheus plans a 1.5 GW islanded campus with onsite generation and a target completion in 2027, contingent on securing a customer and deploying modular construction. The project tests whether private power can replace grid constraints.
U.S. data center water consumption tripled in a decade, and metrics from before the AI boom are outdated. Cooling demand for high-density AI racks will accelerate this trend, raising sustainability and regulatory questions. --- #HostSecure