Security: CVE-2026-33278 cpanel-unbound 1.25.1 Security Release - May 21, 2026

Incident Report for StableHost

Monitoring

An upstream vulnerability was recently reported for Unbound that affects supported cPanel & WHM versions 126 and higher.

Impact

This issue primarily affects:

- Web Hosting Servers (Shared Hosting)
- Managed VPS
- Unmanaged VPS that might be using cPanel.

At this time:

• Shared hosting systems are secured.
• Managed VPS systems are secured.
• No customer action is currently required for shared hosting accounts or VPS managed accounts.
• Unmanaged VPS customers with cPanel may need to take action to patch or mitigate affected systems.

The recommended course of action is as follows (for unmanaged VPS):

• Verify cPanel version
• Apply vendor-provided security updates or mitigations
• Contact Support if assistance is required

cPanel has pushed out an update, including the updated package for the following cPanel & WHM versions:

11.126.0.63 and higher
11.134.0.30 and higher
11.136.0.14 and higher
Posted May 21, 2026 - 18:46 CST
This incident affects: Servers (Amsterdam, NL, Frankfurt, DE, Madrid, ES, Chicago, US, St. Loius, US, San Jose, US, Phoenix, US, Singapore, SG, Stockholm, SE, Turku, FI, Vilnius, Lithuania, Reseller Servers - St. Louis, Reseller Servers - Amsterdam, VPS - Phoenix, VPS - Chicago, VPS - Amsterdam).