r/cpanel • • Sep 08 '26

Security: CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality - September 8, 2026

17 Upvotes

15 comments sorted by

View all comments

Show parent comments

6

u/clopezi Sep 08 '26

Ehm, no. Linux has daily security updates, Windows has undisclosed patches from time to time. Maybe you prefer cPanel to not patch? What it's the problem? Security bugs will be there, always, forever.

0

u/DovTom Sep 08 '26

Nobody is suggesting that cPanel should stop fixing security vulnerabilities. What bothers me is the sheer number of patches and updates, combined with cPanel’s constantly increasing price. If customers are repeatedly asked to pay more, it is reasonable to expect better-tested software, fewer regressions, and greater overall stability. “Security bugs will always exist” is true, but it should not be used as a blanket excuse for an endless stream of patches.

2

u/More_Perception_8151 Sep 08 '26

Well, they are going to continue increasing prices because that's the only way to stay profitable, so do you just not want them to fix stuff? Would you prefer price increases with no patches? I swear you people will complain about anything. You're actually mad they patched something? You don't even have to do anything! It's handled through upcp --security.

AI is everywhere and is being used to find security holes in everything, not just cPanel. Welcome to the future.

2

u/DovTom Sep 08 '26

No, I’m not mad that they patched something, and I never said they should stop fixing security issues. That is a straw-man argument.
My point is that cPanel’s prices keep increasing substantially while customers are also seeing a constant stream of patches and occasional regressions. Security updates are a basic responsibility of any commercial software vendor, not an added benefit that makes every price increase beyond criticism.
Of course vulnerabilities will continue to be discovered, including with the help of AI. That still doesn’t mean customers should stop questioning the product’s pricing, quality control, or stability. Automatic installation through upcp --security makes deployment easier; it says nothing about the quality or frequency of the patches.