Received an email: New in V136 -- security links confusing

mtindor

• May 21, 2026 13:30

Received an email about v136.  It mentioned the Security section to view past security stuff.

https://support.cpanel.net/hc/en-us/sections/360007088193-Security

If you navigate to that URL and look at the latest security updates, they are worded in a very confusing fashion.  Example below.

It says ou pushed out a patch for the following versions (including 11 134.0.29 and higher).  Well, 134.0.29 WAS the updated version to address that vulnerability, and you pushed it out to address versions below 134.0.29.   The article makes it sound like you pushed out security updates FOR 134.0.29 and higher.  Then all of us will go into our 134 installs and see 134.0.29 and wonder why there are no newer versions available to address the security issues -- when in reality 134.0.29 was precisely what was released TO address the security issue.

 

Security: SEC-73755 cPanel & WHM / WP2 Security Update - May 19, 2026

Situation

A vulnerability has been reported that currently affects cPanel & WHM versions 132 and higher.

Impact

We have pushed out a patch for the following cPanel & WHM versions: 

• 11.132.0.35 and higher
• 11.134.0.29 and higher
• 11.136.0.13 and higher

We have pushed out a patch for the following WP Squared version:

• 11.136.1.16 and higher

• 

  William Del Piero cPanel Staff

  • May 22, 2026 14:56

  Hi,

  Thank you for taking the time to share this feedback.

  You're correct in your interpretation: the version listed (e.g., 11.134.0.29) is the patched version itself, not a version that still needs patching. The "and higher" phrasing is intentional to keep the article accurate as newer versions continue to be released, but we understand how it can read as if those versions are the ones affected rather than the ones that contain the fix.

  We'll pass this feedback along to the team responsible for these security notices, as the wording could certainly be clearer.

  In the meantime, if you ever want to verify the latest available version for your release tier, you can query httpupdate.cpanel.net directly:

  % curl --silent http://httpupdate.cpanel.net/cpanelsync/TIERS | egrep "(current|release|edge|stable)"
  edge:11.136.0.14
  current:11.136.0.14
  release:11.134.0.30
  stable:11.134.0.30

  Thanks again for flagging this.

  0

Please sign in to leave a comment.