[CVE-2026-65643]: Affects cPanel & WHM (all supported versions, tiers 110/134/136/138) and WP Squared — the vulnerable component is the domain parking / addon-domain functionality. An authenticated cPanel user permitted to add parked/addon domains can create arbitrary files on the server, leading to code execution as root and full server takeover. Patch by upgrading to 11.110.0.141+, 11.134.0.53+, 11.136.0.37+, 11.138.0.2+, or WP2 11.138.1.7+.