cPanel & WHM May 19, 2026 Emergency Security Update: SEC-73728 and SEC-73755 Patched

On May 19, 2026, cPanel released an emergency Technical Support Release (TSR) addressing multiple security vulnerabilities including two issues identified internally as SEC-73728 and SEC-73755, plus a separate, actively-exploited privilege escalation in the LiteSpeed User-End cPanel Plugin. The release was published approximately 12 hours ahead of the originally scheduled May 20 date because of the active exploitation of the LiteSpeed issue. cPanel has stated that SEC-73728 and SEC-73755 are rated up to High severity. Technical details for both are linked from cPanel's official advisory pages and will be updated by cPanel as their disclosure timeline allows.

If you are a Gotekky managed cPanel customer, the May 19 patch is deploying across our fleet today. No action is required from managed customers. The rest of this guide covers what is known about the release, the patched version numbers, the operational steps for self-managed cPanel operators, and how this release fits into the broader pattern of cPanel emergency patches in spring 2026.

What is in the May 19 release

The cPanel TSR addresses three security issues:

• SEC-73728: a cPanel-identified security issue rated up to High severity. Full technical details are available in cPanel's official support article for SEC-73728. cPanel has not assigned a public CVE identifier as of this guide's publication, which is typical for cPanel-internal security trackers. CVE assignment commonly follows the patch release by days or weeks.
• SEC-73755: a cPanel-identified security issue rated up to High severity. Full technical details are in cPanel's official support article for SEC-73755. Same disclosure-timeline considerations as SEC-73728 apply.
• LiteSpeed User-End cPanel Plugin privilege escalation: an actively-exploited third-party plugin vulnerability. The cPanel update includes an automated fix that uninstalls the plugin. This issue is covered in detail in the dedicated Gotekky security guide on the LiteSpeed User-End cPanel Plugin.

Because cPanel has not published full technical details for SEC-73728 and SEC-73755 as of this writing, this guide focuses on the operational response: get the patch installed, verify the build version, and trust that the cPanel security team's "up to High severity" rating is accurate. Once cPanel publishes the technical details and any CVE assignments, this guide will be updated to reflect them.

Patched versions and the update path

cPanel has released patched builds across the supported version branches. The patched version numbers are listed in cPanel's official May 19, 2026 advisory. CentOS 6 and CloudLinux 6 customers should update to the cl6110 branch (build 11.110.0.120) before applying the standard update process.

The recommended update procedure for self-managed servers:

/scripts/upcp --force

This forces an immediate update, bypassing any scheduled delay. cPanel strongly recommends performing a manual update rather than waiting for the next automatic update cycle, given the active exploitation of the bundled LiteSpeed issue and the High severity rating of SEC-73728 and SEC-73755.

Verify the cPanel build version after the update:

/usr/local/cpanel/cpanel -V

Compare the returned build number against cPanel's published patched build numbers for your branch. If your build does not match, the update did not complete and should be re-run.

Restart the cPanel service daemon to ensure the patched code is running:

/scripts/restartsrv_cpsrvd

What Gotekky did

The May 19 cPanel patch is deploying across our Toronto-based managed infrastructure today. The deployment process verifies the cPanel build number on every managed server after the update completes, restarts cpsrvd, and confirms the LiteSpeed User-End plugin (covered in the separate guide) has been removed where it was previously installed.

We have audited managed servers for indicators of compromise associated with the active exploitation of the bundled LiteSpeed issue. No compromise indicators have been observed on Gotekky managed infrastructure during the exposure window. SEC-73728 and SEC-73755 do not have public proof-of-concepts or active exploitation reports as of this guide's publication, so the compromise audit focuses on the LiteSpeed issue.

For customers on Gotekky managed plans, no action is required. The patch is applied. Build versions match the cPanel-published targets. The LiteSpeed User-End plugin has been automatically removed where it was installed.

Verification checklist for self-managed servers

After running /scripts/upcp --force, work through this checklist to confirm the update completed correctly:

• Confirm the build version: /usr/local/cpanel/cpanel -V should return a build number matching cPanel's published patched version for your branch (86, 110, 118, 126, 130, 132, 134, or 136 family).
• Confirm cpsrvd is running and was restarted: ps aux | grep cpsrvd should show recent process start times.
• Confirm the LiteSpeed User-End plugin is removed: rpm -qa | grep -i litespeed-userend should return no results. If it does, the automated uninstall did not complete.
• Review cPanel's official advisory pages for SEC-73728 and SEC-73755: any version-specific configuration changes or post-update steps will be documented there.
• Check /var/log/cpupdate.log for any update errors: tail -100 /var/log/cpupdate.log will show the most recent update run and any failures.

If you discover the update did not complete successfully, the recommended path is to re-run /scripts/upcp --force, review the cpupdate.log for the specific failure, and engage cPanel support if the failure persists. Do not leave a server unpatched while troubleshooting, given the active exploitation of one of the bundled issues.

The context: this is the third cPanel emergency in three weeks

The May 19 release follows two previous cPanel emergency patches in rapid succession:

• April 28, 2026: CVE-2026-41940, a critical authentication bypass actively exploited as a zero-day since February. Gotekky published a dedicated guide on this issue.
• May 13, 2026: a planned-but-substantial patch covering five CVEs (CVE-2026-29205, CVE-2026-29206, CVE-2026-32991, CVE-2026-32992, CVE-2026-32993) ranging up to High severity.
• May 19, 2026: the current release covering SEC-73728, SEC-73755, and the actively-exploited LiteSpeed plugin issue.

Three emergency cPanel patches in 22 days is well outside historical norms for the platform. Combined with four separate Linux kernel privilege escalation issues disclosed in the same period (Copy Fail on April 29, Dirty Frag on May 7, Fragnesia on May 13, and CVE-2026-46333 ssh-keysign-pwn on May 14), and the WHMCS authorization bypass on May 13, the spring 2026 hosting infrastructure stack has experienced a sustained burst of vulnerability disclosures that the industry has not seen in any comparable window before.

The operational implication is straightforward. Hosting providers running cPanel cannot rely on monthly maintenance windows for security patching anymore. The patch cadence demands continuous deployment automation, automated build-version verification across the fleet, and compromise auditing as a standard part of the post-patch workflow. Gotekky has invested in all three throughout 2026 and the response cadence on these disclosures reflects that work.

What to do if SEC-73728 or SEC-73755 turn out to have public proof-of-concepts

cPanel's "up to High severity" rating for SEC-73728 and SEC-73755 combined with the lack of public technical details suggests these are issues where cPanel preferred to ship the fix before disclosing exploit specifics. This is good security practice and it means that for now, the technical details are unknown to the public. That can change quickly. Security researchers will reverse-engineer the patched binaries and may publish technical details within days or weeks of the release.

If either issue receives a CVE assignment and public proof-of-concept emerges, Gotekky will update this guide with the technical detail and any additional mitigation guidance. In the meantime, the operational response remains: patch immediately via /scripts/upcp --force, verify the build version matches cPanel's published target, restart cpsrvd, and audit for compromise if the server was internet-reachable for an extended period before patching.

For deeper coverage of the broader spring 2026 hosting infrastructure security environment, Gotekky maintains a complete security guide series covering each of the major CVEs and SEC issues disclosed in this window. The series includes the April 28 cPanel authentication bypass (CVE-2026-41940), the four Linux kernel privilege escalation vulnerabilities, the WHMCS authorization bypass (CVE-2026-29204), the actively-exploited LiteSpeed plugin issue from this release, and the current guide on SEC-73728 and SEC-73755. Each guide includes specific mitigation steps, audit checklists, and the context for what Gotekky did on managed infrastructure.