This historical April-May 2026 advisory covers four different hosting-stack vulnerabilities. Determine applicability from the actual component, configuration and distribution advisory; do not run every update command merely because the server uses Linux. The checks below are not a complete current security audit or evidence that a customer server is already remediated.
cPanel authentication bypass: CVE-2026-41940
cPanel's advisory identifies an authentication-bypass issue and lists branch-specific fixes, including DNSOnly and WP Squared context. Match the actual product and branch to that notice. Follow its current update and service-restart instructions, then record the reported version. Check pinned update tiers if the expected fix was not installed.
The vendor also provides detection guidance that has been revised to reduce false positives. Use the current version and preserve findings for investigation. Do not interpret an absence of reported indicators as proof that no compromise occurred.
Kernel privilege escalation: CVE-2026-31431
The issue commonly called Copy Fail requires the applicable distribution's kernel guidance. AlmaLinux's notice describes its fixes; it is not a package-version authority for every other distribution.
Record the operating-system release and running kernel, install the applicable supported fix, and confirm it is active after a planned reboot. If using live patching, verify explicit coverage for this CVE and the running kernel. Package installation alone is insufficient evidence of active kernel remediation.
Apache HTTP/2: CVE-2026-23918
Apache's security record identifies an HTTP/2 double-free issue affecting upstream 2.4.66 and fixed in 2.4.67. Use the supported OS or control-panel package with the relevant fix, accounting for vendor backports. The historical fix version is not a recommendation to stop applying later updates.
Check which Apache installation serves requests and whether HTTP/2 is enabled. Do not enable a testing repository on a production host simply because an early advisory used it. Validate configuration before the required reload or restart and test an actual site afterward.
OpenSSH certificate principals: CVE-2026-35414
The OpenSSH 10.3 release notes describe incorrect matching of certain comma-containing certificate principals against an authorized_keys principals list. This specific issue concerns user-trusted CA keys in authorized_keys; the documented TrustedUserCAKeys/AuthorizedPrincipalsFile path is not affected by that matching bug.
Review the actual certificate-authentication configuration and installed server package. A local ssh -V reports the client version, not proof that the running server is fixed. Use the distribution's advisory and package evidence. Validate server configuration, retain console access and test a second authorized session before closing the existing one after a change.
Build a host-specific remediation record
- Record the component, installed package, running version, exposure and applicable advisory.
- Assign an administrator and recovery path; preserve relevant logs and tested backups.
- Apply supported updates through the appropriate vendor channel.
- Perform the required service restart, reboot or verified live-patch step.
- Test control-panel access, SSH access and representative application requests.
- Record unresolved indicators and escalate suspected compromise separately from patching.
Avoid blanket distribution upgrades or forced restarts without checking dependencies and remote recovery. If these checks cannot be completed, record the unresolved state rather than calling the host secure.
The later May cPanel and Dirty Frag advisory covers another vulnerability set. WebCare360 publishes this guidance as a hosting provider; actual patch assistance and customer status require confirmation for the specific service.
