cPanel Mail Privilege Escalation Affected All Supported Versions; Automattic Board Places Matt Mullenweg on Paid Leave
My Take
What happened cPanel patched CVE-2026-67401, a vulnerability that allowed a mail-privileged account to reach root on every supported version of the platform.
Why it matters to hosts If you run cPanel servers and haven't audited which accounts have mail privileges, you need to do that now—this flaw means a compromised mail account becomes a full server compromise, and it affected every version in active use.
What to do Review your cPanel accounts and audit which ones have mail privileges enabled; apply the patch immediately and consider whether mail privileges can be restricted or removed for accounts that don't strictly need them.
My view This is a privilege escalation in the control panel itself, not a weakness in mail software or system configuration—it's a cPanel issue that hosts cannot work around without patching. The fact that it touched every supported version suggests the flaw was in core account handling logic rather than a recent regression.
How do you currently audit or restrict mail privileges across your cPanel accounts, and would a control panel feature to enforce mail-only accounts (without system-level access) change your security posture?
Key Themes
Notable Players
Patched CVE-2026-67401, a privilege escalation flaw affecting all supported versions that allowed mail-privileged accounts to reach root.
Board placed founder Matt Mullenweg on paid leave; CFO Mark Davies became interim CEO amid disputes over company direction.
Launched unified Hostinger Agent, consolidating customer support, marketing, and SEO assistants into a single AI tool that performs tasks rather than routing to humans.
Rolled out Ask Aida, a conversational agent inside the control panel that completes 95% of account tasks in testing, with humans coaching for edge cases.
Deployed post-quantum DNSSEC validation on 1.1.1.1 using NIST's ML-DSA-44 algorithm and launched Automatic Key Exchange to negotiate the most secure TLS key agreement with origins.
Top Stories
CVE-2026-67401 allowed a mail-privileged cPanel account to escalate to root on the server. Every supported cPanel version was affected and requires immediate patching.
Automattic's board placed founder Matt Mullenweg on paid leave with CFO Mark Davies taking interim CEO role. Mullenweg remains involved with the WordPress project, creating governance ambiguity.
Hostinger unified its customer support, marketing, and SEO agents into Hostinger Agent, which now performs account tasks directly with human coaching for edge cases instead of routing escalations.
Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures using NIST's post-quantum ML-DSA-44 algorithm. The shift signals production readiness for quantum-resistant cryptography in DNS.
Server shipments continue to rise despite price increases as enterprise and government buyers join hyperscalers in the AI infrastructure spending surge. Supply constraints remain.
Security & Compliance
WAF false positives (blocking logins, contact forms) require network-layer troubleshooting before loosening rules. Identify legitimate traffic patterns first to avoid over-permissive security policies.
Cloudflare's Automatic Key Exchange probes customer origins to detect post-quantum TLS support and negotiates the most secure algorithm. Hosts using compatible origins get quantum-resistant handshakes by default.
Cloud & Infrastructure
InMotion Cloud launched a fixed-price Managed Private Cloud on bare metal with predictable monthly rates, zero egress charges, and U.S. support. Pricing clarity differentiates from spot-market alternatives.
Pricing & Business
IONOS announced a 12% workforce reduction (450 roles, dropping from 3,800 to 3,350 employees) despite raising its revenue guidance in August. The move signals cost-control priority despite growth.
SolusVM raised its pricing by 29%, a significant increase for VPS management platform customers. Timing creates cost pressure for hosting providers already managing margin compression.
Automattic's board removed Matt Mullenweg as CEO and put him on paid leave. Mullenweg claims board conspiracy; the move creates uncertainty for the WordPress ecosystem and hosts dependent on it.
Control Panels
group.one deployed Ask Aida, a conversational control panel agent that handles 95% of customer account tasks directly. Only three task categories still route to human support staff.
Acquisitions & Market
cyber_Folks (the Polish group holding the cyber_Folks hosting brand) disclosed PLN 1 billion (~€232M) in acquisition capacity, but stated that hosting is not their acquisition focus going forward.
Domains & DNS
Guide to setting up domain redirects in Bluehost for rebranding, site migrations, or www-variant consolidation. Domain redirects preserve traffic when moving to a new URL.
Walkthrough of DNS record management in Bluehost. Getting DNS right is critical for email, web services, and integrations; mistakes cause outages for customers.
Technology & Tools
AI workload performance depends on network latency, resilience, and data visibility across data centers and clouds, not just GPU compute. Network design is now as critical as accelerator hardware.
A large Linux kernel release candidate prompted Linus Torvalds to joke about blaming AI. The release reflects ongoing Linux development velocity and complexity.
Intel processed over 1 million High-NA EUV wafers and leads the industry in advanced semiconductor manufacturing. Progress on 6×12 photomasks aims to speed production and reduce costs.
Community & Events
ReliableSite expanded bare metal dedicated server offerings to Amsterdam and Querétaro, Mexico. International expansion extends geographic footprint for customers seeking regional proximity.
Other News
Google secured a 22-year power agreement covering up to half the Loviisa nuclear plant's capacity for its Finland data center expansion. Long-term power contracts are now the foundation of hyperscale infrastructure strategy.
Nscale captured $3.7B of the UK data center sector's $5.7B investment total in recent period. AI infrastructure funding concentration reflects market consolidation around major providers.
U.S. data center electricity demand is surging, forcing developers to secure scalable, reliable power commitments before site selection and construction. Power availability, not real estate, is now the primary constraint.
Thailand suspended all new data center construction and approval processes pending completion of a legal framework defining requirements for large-scale facilities. Regulatory uncertainty delays regional infrastructure growth.
Thailand asked operators to halt 49 ongoing data center projects while new legislation establishes governance standards. Regulatory delays create risk for operators with capital committed to the region.
ABF substrates that underpin AI chips face supply and technical bottlenecks as accelerator packages expand. Substrate availability is now a limiting factor in AI hardware scaling.
Data center GPUs last 5+ years physically but face economic replacement in 2-4 years due to performance advances. GPU-as-a-Service and resale models help maximize value from aging accelerators.
Patagonia's abundant water for cooling and cheap energy attract Big Tech interest for mega data centers, but poor fiber connectivity limits viability without major infrastructure investment. --- #HostSecure