There are other websites on the server your website lives on. What stops them reaching yours? You have probably wondered it yourself and never asked, partly because it feels like a silly question, and partly because hosting companies tend not to volunteer the answer. It is not silly. It is the right question, and a security release from cPanel on 22nd September is a good reason to sit down and answer it properly.
What shared hosting actually is
Shared hosting puts many customers’ websites on one physical server, which is why it costs pounds rather than hundreds of pounds a month. The honest picture is a building of flats. You have your own front door and your own rooms, and nobody else can walk in. But the foundations, the plumbing and the roof are shared, and the separation between flats is something a builder constructed, not a law of nature. Built separation is real separation. It is also only as good as its construction and its upkeep, and that is really what the rest of this article is about.
The three walls
So what are the walls actually made of? Three things. First, every customer is a separate user account on the server, and file permissions stop one account reading another’s files. Second, every customer’s databases have their own database users, with access only to their own data. Third, process isolation keeps each site’s running code inside its own compartment, so one site’s programs cannot reach into another’s memory or files. None of this is assumed. It is engineered, it is software, and like all software it occasionally has flaws. What matters, given that, is how quickly the flaws get fixed, which brings us to 22nd September.
What cPanel fixed on 22nd September
cPanel, the control panel behind a very large share of the world’s shared hosting, shipped a security release fixing three flaws, and the two serious ones are exactly the two things you would worry about.[1]
Before we go further, a card on the table. cPanel is not the control panel on Lucid Cloud Platform hosting: our shared, WordPress and managed plans run our own panel, so this is not a story about those servers. But cPanel is everywhere in this industry. A huge share of the shared hosting sold in this country runs it, and if you rent a private server, from us or from anyone, cPanel is a popular option to install on it. If that is you, this is a story about your server.
One customer becoming the machine. CVE-2026-87899, rated 9.4 out of 10, sat in the calendar and contacts service. It allowed any logged-in cPanel account to run code as root, which is the server’s master key: full control of the machine and, with it, every site on it.[1][3]
One customer reaching another’s data. CVE-2026-87900 sat in WP Toolkit, the component that manages WordPress installations from inside the panel. A flaw in how it creates databases let one logged-in customer modify databases belonging to other accounts on the same server. It affects WP Toolkit 6.11.2-10794 and earlier, and is fixed in 6.11.3.[1][2]
A third flaw, CVE-2026-68490, exposed calendar and contact data between accounts and was fixed in the same release.[1]
Two things are worth saying plainly. Neither serious flaw had been seen exploited in the wild as of late September, and cPanel’s advisories say the same; this was fixed before it became an incident, which is how the system is supposed to work.[1] And both require the attacker to be a logged-in cPanel user. That is a real condition, but on shared hosting it is a low bar: an account on a shared server can be bought for a few pounds, from the same public order form you used. The wall between accounts has to hold against paying customers, because some of them are not customers in good faith.
Why does the control panel keep appearing in stories like this? Because a control panel acts across accounts by design. It creates them, moves them and manages them, so it runs with privileges no individual customer has. That is not a design error; it is what a control panel is. It does mean a flaw in the panel has a different shape from a flaw in a website, which is why panel updates deserve the same urgency as anything else on the server.
Cloudflare had the same class of problem in September, and showed how to handle it
Cross-tenant isolation is hard at every scale, not just on £5 hosting. On 24th September, Cloudflare disclosed that a customer of its Containers products could recover leftover disk fragments from other customers’ workloads, because a shared storage pool had been configured to skip wiping reused blocks; recovered material included directory structures and complete database files.[4] The dates are the lesson: reported by researcher Oren Yomtov of Accomplish on 4th September, mitigated across the fleet by 19th September, disclosed on 24th September with the exact mechanism explained, evidence checked, no customer action required.[4] We point at that not to criticise Cloudflare, who handled it well, but because it is the standard worth judging any provider against, ourselves included: fix quickly, explain plainly, and say what you checked.
Where we stand
Because cPanel is not our control panel, there was nothing for us to patch on our hosting platform this time, and we are not going to dress that up as virtue. It is the luck of the stack. Our panel is software too, and software takes its turn; when a security release lands for what we do run, the patching is our job rather than yours, and it happens without a maintenance email asking you to do anything.
One exception, stated plainly. cPanel is available as an option when configuring a Velocity VPS, and some customers choose it. A private server is yours to run, that is its whole point, and the control panel is part of the deal. So if your VPS runs cPanel, with us or with anyone, make sure it is on the 22nd September release and that WP Toolkit is on 6.11.3 or later, today. If you are not sure where to look, our support team will point you in the right direction.
What matters on any stack is what this article has been about all along: isolation that is engineered deliberately, vendor fixes applied as routine rather than heroics, and a host that will answer plain questions about both. On our platform, that isolation looks like this: every site runs in its own isolated environment, with its own file system view, its own database users and defined resource limits, so one customer’s code cannot read another customer’s files or touch another customer’s data.
What to ask any host, including us
- Which control panel do your servers run, and did the 22nd September cPanel release apply to them?
- How quickly do you apply vendor security releases, and what happened with this one specifically?
- Will you tell me when you have applied one, and where?
- Is WP Toolkit, or your equivalent, on 6.11.3 or later?
- Do you publish maintenance and security updates anywhere I can check?
A host that answers those within a day is telling you more than any feature list can. A host that cannot answer them is also telling you something.
What stays yours
The building is the host’s job; the flat is still yours. Keep WordPress and its plugins current, keep administrator accounts few and passwords unique, and treat your own site’s security as your side of a shared wall, because that is what it is. And if you would rather not share a machine at all, that option exists: our Atlas managed cloud and Velocity VPS plans put your site on resources of its own. The trade-off is cost, and for most small sites shared hosting remains the right answer, which is exactly why the walls between accounts deserve the attention this article has given them.
Related reading
- When the cloud goes down: what three outages in three months mean for your website
- The complete WordPress security guide for small businesses
Sources
- New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control, The Hacker News, September 2026.
- New cPanel Vulnerability Allows Attackers to Access Other Users’ Accounts, Cybersecurity News, September 2026.
- CVE-2026-87899 record, Strix, September 2026.
- How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers, Cloudflare, 24th September 2026.
