Photo by Levart_Photographer on Unsplash
In the hosting world, we often worry about the front door—DDoS attacks, firewall breaches, and brute-force attempts. But sometimes, the threat is already inside, sitting quietly in a standard user account. It is a reminder that the perimeter isn't the only place where things can go sideways.
A recent security disclosure has highlighted a vulnerability within cPanel’s CalDAV and CardDAV implementation. According to reports, an authenticated account holder could escalate their privileges to achieve full root access. The flaw, identified as CVE-2026-87899, essentially allows someone with a basic hosting login to execute code as the superuser. No special permissions or complex environments were required; if you had an account, you had a potential path to the keys to the kingdom.
Why it matters
This isn't just another patch cycle entry. For those of us who have spent decades in the shared hosting space, local privilege escalation is the stuff of nightmares. Shared hosting relies on the absolute integrity of the boundary between users. When a calendar or address book synchronization tool becomes a vector for taking over the entire machine, it challenges the fundamental economics of the multi-tenant model.
For service providers, this underscores the necessity of automated update pipelines. In the old days, we might wait for a maintenance window to push updates, but the speed at which exploits are weaponized today doesn't allow for that luxury. If you aren't running tiers that auto-update these critical binaries, you are effectively leaving a set of master keys under the welcome mat for any customer who decides to get curious.
It is somewhat ironic that the tools designed to keep us organized—calendars and contacts—are the very things that could throw a sysadmin's week into complete disarray.
The Bottom Line
Security is never a 'set it and forget it' task, especially when dealing with legacy protocols that have been extended for the modern web. The lesson here is simple: keep your software current, or eventually, your users will become your administrators.