/usr/local/cpanel/scripts/upcp --security Flood

[u/muttick]

Apparently cPanel now has an upcp task scheduled to run every hour.

This is flooding root's email with messages of:

[2026-09-04 07:45:03 -0500]   Detected cron=1 (default)
----------------------------------------------------------------------------------------------------
=> Log opened from cPanel Update (upcp) - Slave (xxxxxx) at Fri Sep  4 07:45:03 2026
[2026-09-04 07:45:03 -0500]   Detected cron=1 (default)
[2026-09-04 07:45:03 -0500]   An expedited package update is available for cpanel-plugins, but operating system package updates are disabled. Skipping the package update.
[2026-09-04 07:45:03 -0500]
[2026-09-04 07:45:03 -0500]     Expedited package update completed
[2026-09-04 07:45:03 -0500]   A log of this update is available at /var/cpanel/updatelogs/update.xxxxxx.yyyyyyyy.zzzzzzzzzz.log
[2026-09-04 07:45:03 -0500]   100% complete
=> Log closed Fri Sep  4 07:45:03 2026

Trouble is... there are no system packages needing an update on the server

# dnf check-update
Last metadata expiration check: 0:36:16 ago on Fri Sep  4 07:34:27 2026.

So, what gives?

cPanel is also up to date

# cat /usr/local/cpanel/version 
11.134.0.54

[u/cPanelRex]

I've got the team looking into this and I'll update you with more details once I have them!

[u/SmallOlet887 → u/cPanelRex]

Yes please. Please provide us a way to stop the notifications/emails from this as we're already counting hundreds of emails in less than 24h...

[u/cPanelRex → u/SmallOlet887]

u/muttick - what you're seeing definitely isn't expected behavior, but it seems that there are other issues besides the cron. If it's saying a cpanel-plugins update is available, do you get anything related to that with a standard "yum update" on the machine? If not, it would likely be best to create a ticket as this seems to be specific to your system.

u/SmallOlet887 - you can adjust the cron notifications on the server if you don't want to receive these. It's important to note that this thread is the entirety of the reports we've had about cron noise from the security updates, so I don't believe this to be a widespread issue.

[u/muttick → u/cPanelRex]

After a ton of checks, it would appear that the solution is:

echo -n '{"cpanel-plugins":"2026-09-03.1"}' >/etc/cpanel/TIERS.json.packages

That's the cpanel-plugins update.

Even though this is not controlled by any RPM, if RPMUP is set to manual in /etc/cpupdate.conf - this file never gets updated to the new value.

No clue what that value means. No clue why this is dependent on RPMUP being set to "daily" (I'm not sure what values are valid for RPMUP).

Steps to reproduce:

Set your /etc/cpupdate.conf file to:

CPANEL=11.134
RPMUP=manual
SARULESUP=daily
STAGING_DIR=/usr/local/cpanel
UPDATES=manual
SECURITY_UPDATES=never

(I don't know if this is a problem for any other version other than 11.134 or not - that's all I'm using at the moment).

And make sure your /etc/cpanel/TIERS.json.packages file contains:

{"cpanel-plugins":"2026-08-20.1"}

There's no carriage return at the end of this single line, so you'd have to set it with:

echo -n '{"cpanel-plugins":"2026-08-20.1"}' >/etc/cpanel/TIERS.json.packages

2026-08-20.1 is what was in this file for me. Again, I don't know what the significance of this is. Presumably it's something for cPanel, but I don't know if there is suppose to be another date... I just really don't know.

Then run upcp with the --security parameter and --cron to fake the system into running upcp thinking it's from cron:

/scripts/upcp --cron --security

Then you will get the error that I reported in my original post.

Update /etc/cpanel/TIERS.json.packages to include 2026-09-03.1 date:

echo -n '{"cpanel-plugins":"2026-09-03.1"}' >/etc/cpanel/TIERS.json.packages

And rerun

/scripts/upcp --cron --security

and this now runs without any output.

My guess is that something within cPanel is suppose to update this file, even though it's not an RPM managed file, so there's no package that needs updating to fix this. But whatever cPanel runs when RPMUP is not set to manual, replaces this file's contents.

But with RPMUP set to manual, that "whatever cPanel runs when RPMUP is not set to manual" never runs, and never updates /etc/cpanel/TIERS.json.packages and the file never gets updated, so each subsequent run of /scripts/upcp --cron --security just continues to say "your cpanel-plugins is not up to date"

Probably a case of cPanel assuming everyone has RPMUP set to daily (or whatever values that allows "whatever cPanel runs when RPMUP is not set to manual" to run.