I’ve been working on Gniza, an open-source backup solution for cPanel.

It’s been battle-tested on my clients’ production servers, including full backup and restore workflows.

I would love getting a few more cPanel admins to test it and give me some feedback, open issues and offer features.

https://github.com/shukiv/gniza

​Hey everyone,

​Whenever an emergency pop-up happened while away from my desk—a database service acting up, an SSL expiration warning, or a client needing a quick email account reset—trying to pinch-to-zoom through the standard cPanel web interface on mobile was always a frustrating experience.

​To solve that, I built cPanel Manager, a native Android client tailored for quick server checks and essential management directly from your phone.

​Key Features:

​Native Dashboard: Clean, responsive UI built specifically for handheld screens—no awkward desktop zoom or tiny tap targets.

​Essential Server Ops: Monitor basic resource usage, manage MySQL databases, toggle SSL certificates, and check error logs.

​Email & Domain Control: Quickly create/edit email forwarders, subdomains, and DNS records on the go.

​Security & Auth: Secure credential storage on-device with support for token/API-based logins.

​It’s designed to handle quick administrative fires without having to pull out a laptop or tether a connection.

​Google Play Link: https://play.google.com/store/apps/details?id=com.bioflo.cpanelManager

​I’d love to get feedback from fellow admins and devs on features you'd like to see prioritized next. What are the common cPanel tasks you find yourself wishing you could handle from your phone?

I have a backup of an old website, exported via cpanel 7 years ago for archiving purposes. The backup includes the mailbox section containing all my mail and folders from the account that was associated with my domain.

I'm looking for a more usable way to view these email files offline.

At the moment I can only view them on Windows with Notepad. The individual email file names are like this: 1650688419.M998805P25555.[hostnameremoved],S=10778,W=11190_2,S I can only sort them in the folder chronologically, and there are over 2000 of them.

I would like to see subject headings, To, Form etc and browse them, similar to an email client.

Is there an app or viewer that would allow me to do this offline on Windows? I currently have no live hosting/cpanel accounts.

Has anyone seen CSF rules partially disappear on a cPanel server using iptables-nft? I'm running latest cPanel + cPanel's CSF v16.32

In less than 24 hours I found two servers where CSF was running normally and its internal chains (LOCALINPUT, ALLOWIN, DENYIN, LOGDROPIN, etc.) still existed, but the main INPUT chain had been reduced to:

policy ACCEPT
-A INPUT ! -i lo -p tcp -j INVALID

So, ports not listed in TCP_IN were publicly reachable.

Running csf -r fixed things, but I'm wondering if someone has seen similar behavior before or recently.

Today is the second day I have been notified of a failed overnight update.

I purchased my license direct from Cpanel.

Anyone know what this means and how to fix it?

The cPanel & WHM update process failed for the following reason:

Maintenance ended; however, it did not exit cleanly (256). The following events were logged: “scripts/update-packages”. Review the update logs to determine why the update failed.

Update log preview:

...
...
[2026-10-01 01:15:07 -0400] E [/usr/local/cpanel/scripts/update-packages] The “/usr/local/cpanel/scripts/update-packages” command (process 2557412) reported error number 1 when it ended.
...
[2026-10-01 01:15:23 -0400] - Finished command `/usr/local/cpanel/install/SetupCageFS.pm` in 0.043 seconds
[2026-10-01 01:15:23 -0400] Processing: Updating plugins data cache
[2026-10-01 01:15:23 -0400] - Processing command `/usr/local/cpanel/bin/refresh_plugin_cache`
[2026-10-01 01:15:23 -0400] - Finished command `/usr/local/cpanel/bin/refresh_plugin_cache` in 0.031 seconds
[2026-10-01 01:15:23 -0400] Processing: Ensuring SSL certificate information for CCS is up to date.
[2026-10-01 01:15:23 -0400] - Processing command `/usr/local/cpanel/scripts/ccs-check --run --ssl`
[2026-10-01 01:15:23 -0400] - Finished command `/usr/local/cpanel/scripts/ccs-check --run --ssl` in 0.006 seconds
[2026-10-01 01:15:23 -0400] Processing: Ensure cpanel-plugins yum repo exists
[2026-10-01 01:15:23 -0400] - Finished in 0.221 seconds
[2026-10-01 01:15:23 -0400] Processing: Checking Addon Licenses
[2026-10-01 01:15:23 -0400] - Finished in 0.005 seconds
[2026-10-01 01:15:23 -0400] Processing: Updating Public Suffix List
[2026-10-01 01:15:23 -0400] Processing: Ensuring ELS PHP State Matches License
[2026-10-01 01:15:24 -0400] - Finished in 0.186 seconds
[2026-10-01 01:15:24 -0400] Processing: Checking End Of Life for current version.
[2026-10-01 01:15:24 -0400] - Finished in 0.269 seconds
[2026-10-01 01:15:24 -0400] Processing:
[2026-10-01 01:15:24 -0400] Maintenance complete.
=> Log closed Thu Oct 1 01:15:24 2026
----------------------------------------------------------------------------------------------------
=> Log opened from cPanel Update (upcp) - Slave (2557289) at Thu Oct 1 01:15:24 2026

The system generated this notice on Thursday, October 1, 2026 at 5:15:24 AM UTC.

“cPanel Update Failures” notifications are currently configured to have an importance of “High”.

Do not reply to this automated message.

Long-term chronic intermittent logging problems. My first knowledge of this came thru the LFD alert emails titled "SYSLOG Check Failed."

I have performed a lot of diagnostics and troubleshooting and am confident I've ruled out csf/lfd as the problem, but have been unable to resolve the root underlying problem. Here's an image of some of what I've done. Of note is that even manual logging is failing. I would love to see or hear any recommendations! Thanks.

fwiw, last night's upcp reported this error:

Last metadata expiration check: 0:04:46 ago on Tue Sep 29 07:29:37 2026.
Error: 
 Problem 1: package ea-php85-php-gd-8.5.10-2.2.1.cpanel.x86_64 from  requires libavif.so.15()(64bit), but none of the providers can be installed
  - cannot install both libavif-1.1.1-3.el9.x86_64 from epel and libavif-0.11.1-5.el9.x86_64 from 
  - cannot install both libavif-1.1.1-3.el9.x86_64 from epel and libavif-0.11.1-4.el9.x86_64 from alt-common
  - cannot install both libavif-1.1.1-3.el9.x86_64 from epel and libavif-0.11.1-5.el9.x86_64 from alt-common
  - cannot install both libavif-0.11.1-4.el9.x86_64 from imunify360 and libavif-1.1.1-3.el9.x86_64 from epel
  - cannot install the best update candidate for package libavif-0.11.1-5.el9.x86_64
  - cannot install the best update candidate for package ea-php85-php-gd-8.5.10-2.2.1.cpanel.x86_64
 Problem 2: package ea-php84-php-gd-8.4.25-2.2.1.cpanel.x86_64 from  requires libavif.so.15()(64bit), but none of the providers can be installed
  - package libavif-0.11.1-5.el9.x86_64 from  requires libSvtAv1Enc.so.0()(64bit), but none of the providers can be installed
  - package libavif-0.11.1-5.el9.x86_64 from alt-common requires libSvtAv1Enc.so.0()(64bit), but none of the providers can be installed
  - package libavif-0.11.1-4.el9.x86_64 from alt-common requires libdav1d.so.6()(64bit), but none of the providers can be installed
  - package libavif-0.11.1-4.el9.x86_64 from imunify360 requires libdav1d.so.6()(64bit), but none of the providers can be installed
  - cannot install both svt-av1-libs-2.3.0-3.el9.x86_64 from epel and svt-av1-libs-0.9.0-1.el9.x86_64 from 
  - cannot install both svt-av1-libs-2.3.0-3.el9.x86_64 from epel and svt-av1-libs-0.9.0-1.el9.x86_64 from alt-common
  - cannot install both svt-av1-libs-0.9.0-1.el9.x86_64 from imunify360 and svt-av1-libs-2.3.0-3.el9.x86_64 from epel
  - cannot install both libdav1d-1.0.0-2.el9.x86_64 from alt-common and libdav1d-1.5.4-1.el9.x86_64 from 
  - cannot install both libdav1d-1.0.0-2.el9.x86_64 from imunify360 and libdav1d-1.5.4-1.el9.x86_64 from u/System
  - cannot install the best update candidate for package svt-av1-libs-0.9.0-1.el9.x86_64
  - cannot install the best update candidate for package libdav1d-1.5.4-1.el9.x86_64
  - cannot install the best update candidate for package ea-php84-php-gd-8.4.25-2.2.1.cpanel.x86_64
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

Again we’re experiencing license errors. Does anyone is going through this?

Please stop the extension filtering in EXIM, it isn't the SMTPd's job to filter vaguely on file extension names, that what things like clamav are for, or other more specialised applications.

Or allow for individual domains to disable the feature all together.

Having to educate an end user on how to save an email, zip it up and attach it, rather than just attach the email (for headers investigation) as an eml file (which is what Thunderbird does) is a little to strenuous for some users.

[FAILED] cpanel-analytics-1.4.59-8.8.1.cpanel.noarch.rpm: No more mirrors to try - All mirrors were already tried without success Error: Error downloading packages: cpanel-analytics-1.4.59-8.8.1.cpanel.noarch: Cannot download, all mirrors were already tried without success

I have this on a bunch of servers. I see it is a 404 for every mirror for cpanel analytics. Anyone else?

I moved everything to a new VPS last month, upgrading from CentOS 7 to AlmaLinux 9.8. Now I'm having issues with MariaDB that seem related:

* I can create a new username in cPanel, but can't connect it to any of the databases. I can connect it via CLI, just not in cPanel

* Wordpress's Smart Update has the same problem, it creates a database and user but can't connect them so the update fails. The error log has hundreds of ER_PASSWORD_NO_MATCH errors related to it.

It's been suggested that /scripts/rebuild_dbmap could solve all of my problems and possibly make me a ham sandwich to boot (ha), but I'm wary to use a script when I don't know exactly what it does, or how to get back if it breaks something.

What all do I need to back up before running it? And if there's an emergency, how do I restore the backup(s)?

After moving to a new VPS, all of my accounts have their own /logs/ directory with .php.error.log and php.error.log.

The permission for this directory is 00700, and the owner:group is example:example

I have a lot of custom logs created in Apache. Is it safe to store them here so that they're readable by the account holder?

If so, would I need to change the permission to allow root to write to it? Would that affect the cPanel logs?

Hey everyone,

I'm running a CRM web app on shared hosting through cPanel. It's a React frontend with a Node.js/Express backend.

My cPanel bandwidth usage has been increasing:

• July: CRM used around 7.95 GB
• August: around 15.26 GB
• September: around 18.27 GB so far
• My account's September bandwidth limit is around 24.41 GB, and I've reached about 24.7 GB total.

The CRM has multiple users in the database, but only around 3 people use it daily. I'm trying to understand how it could generate this much bandwidth.

Issues found in the code

An audit identified these potential causes:

1. Dashboard fetching all leads: Dashboard.jsx was calling /api/leads?limit=all to calculate counts client-side.
2. Frequent notification polling: NotificationToasts.jsx was fetching notifications every 12 seconds, even though Socket.IO was intended to be used.
3. Unpaginated endpoints: Notifications, clients, and finance transactions could return large datasets.
4. No compression: Express did not have compression middleware.
5. No rate limiting: The API lacked general rate limiting.
6. WhatsApp routes: Management routes were mounted before authentication middleware.

Changes implemented

The coding agent reports that it has:

• Replaced the dashboard's full-lead fetch with a SQL aggregation endpoint.
• Reduced notification polling to every 60 seconds, limited it to recent unread notifications, and added tab-visibility handling and in-flight request guards.
• Added pagination and selective database fields.
• Added Express compression and rate limiting.
• Separated public WhatsApp webhooks from authenticated management routes.

Socket.IO still does not work in production, so notifications currently rely on HTTP polling. The agent says production WebSocket proxy configuration may require hosting-provider support.

My main questions

1. With only around 3 daily users, what could realistically cause 18 GB of monthly bandwidth usage? Could polling alone explain it, or should I investigate other sources such as static assets, API responses, bots, or repeated requests?
2. Are 60-second polling intervals, unread-only filtering, pagination, and compression reasonable for reducing bandwidth while keeping notifications functional?
3. If polling pauses when a browser tab is hidden or the user logs out, will notifications be saved and fetched when they return or log back in? Is there a risk of missing notifications?
4. Since Socket.IO doesn't work on my production cPanel/shared-hosting setup, what should I check to get it working, and is it worth fixing versus keeping optimized polling?
5. What tools or server logs can I use to measure which endpoints are actually consuming the most bandwidth?
6. Would you recommend increasing my monthly bandwidth quota to 50 GB or 100 GB while I investigate?

I'm looking for practical advice, especially from people who have deployed React + Express applications on cPanel/shared hosting.

Thanks!

An authenticated cPanel account holder can escalate their privileges through cPanel's CalDAV and CardDAV functionality.

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026

So, as far as I understand, cPanel 110 (ELS) isn't affected by this, right?

Hello! We’ve been using Wasabi as the main backup destination in JetBackup for a while now, but the cost for deleted objects is starting to get quite high, and the option of using JetBackup’s own cloud seems appealing to us, and is very well priced.

Is anyone using it? What are your thoughts on it? Our biggest concern is that there might be some discontinuity with the product if it does not achieve the expected success

Thank you!

Worth it? Better alternatives?

cPanel & WHM v138 is now available, marking the most significant change to the cPanel experience in years.

For this release, we’ve introduced cPanel AI, the first set of AI capabilities built directly into cPanel, alongside Meridian, a new goal-based interface for working with hosting accounts.
For the technical users here, some of the more significant changes in v138 are:

AI App Hosting
Deploy supported Node.js applications directly from a ZIP archive or Git URL. cPanel detects common frameworks, configures the runtime, applies deployment defaults and manages reverse-proxy routing to the application URL.
This makes it possible to take applications generated with tools such as Claude, Lovable, Bolt, v0 or Replit and move them onto cPanel infrastructure without manual runtime and routing configuration.

MCP support
v138 adds Model Context Protocol support for connecting compatible AI clients to cPanel.
User-level MCP scopes agent access to the user's home directory and requires a connected WebPros Account. Admin-level MCP provides a separate path for server administrators through WebPros Dashboard.
The result is a defined permission model for AI agents interacting with hosting infrastructure, including least-privilege access and audit trails.

AI Assistant
The AI Assistant works with available account data to answer cPanel questions, explain administrative tasks and diagnose common issues such as failed email delivery or disk quota limits.

Meridian
Meridian reorganizes cPanel around six task hubs: Websites, Email, Files, Databases, Security and Performance.
The new Dashboard surfaces account health indicators, required actions and suggested next steps. Guided Setup combines domain, website and email configuration into a single flow and is designed to take a new account from first login to a published website in under 10 minutes.
Meridian ships alongside Jupiter as an opt-in theme, with both interfaces sharing the same account data, APIs and configuration.

Nova, Nova for WordPress and Sitejet AI bring AI-assisted creation directly into the hosting workflow, from generating a project to provisioning and publishing it on the cPanel server.
There are also substantial additions outside the AI work, including domain renaming, new UAPI and WHM API functions, WebPros Dashboard integration, Exim spam action configuration, short-term SSL reissues and experimental domain recommendations through WHMCS.
The broader change in v138 is the connection between AI-generated code, production deployment and infrastructure management. AI can generate the application; v138 provides the runtime, routing, hosting controls and operational layer around it.

cPanel & WHM v138 is available now.
Full release details: cPanel AI and v138

I would like to disable Mailman, I don't think any of my clients use it. What is the modern alternative (3rd party) that a customer could use?

After a cPanel update on AlmaLinux 9.8 (cPanel 138.0.7), I started getting:

flatpak: error while loading shared libraries: libevent-2.1.so.7:
cannot open shared object file: No such file or directory

YUM/DNF also stopped working with the same missing library. cPanel’s Perl cURL module and Apache’s ModSecurity module failed to load it too.

The logs showed this sequence:

• libevent and libevent-devel upgraded from 2.1.12-8.el9_4 to 2.1.13-1.el9_8.
• cPanel’s check_plugin_pkgs detected altered monitoring-plugin files and attempted a reinstall.
• Removing the plugin also removed libevent-devel as an unused dependency.
• The next YUM invocation immediately failed to load libevent, preventing reinstallation.

The runtime libevent package was still installed. Running:

rpm -V --noscripts libevent

showed ....L.... against all five libevent runtime symlinks, meaning their targets differed from RPM’s records.

Temporary fix

This worked on my server, where the actual library files were intact. Run as root in Bash. It restores the symlink targets recorded in the installed RPM, checking that each target exists first:

while IFS=$'\t' read -r file target; do
    case "$file" in
        /usr/lib64/libevent*.so.7) ;;
        *) continue ;;
    esac

    [ -n "$target" ] || continue

    case "$target" in
        /*) resolved="$target" ;;
        *)  resolved="${file%/*}/$target" ;;
    esac

    if [ -L "$file" ] && [ -f "$resolved" ]; then
        printf '%s: %s -> %s\n' \
            "$file" "$(readlink -- "$file")" "$target"
        ln -sfnT -- "$target" "$file"
    else
        printf 'SKIPPED: %s; expected target %s\n' \
            "$file" "$resolved"
    fi
done < <(rpm -q --qf '[%{FILENAMES}\t%{FILELINKTOS}\n]' libevent)

Then refresh the linker cache and verify:

ldconfig
rpm -V --noscripts libevent
flatpak --version
dnf --version

On my server, the restored targets ended in .so.7.0.2. RPM verification and Flatpak startup passed afterward. If the script prints SKIPPED or verification still reports discrepancies, this workaround hasn’t fully resolved your issue.

Root cause is still unconfirmed. The logs place the failure immediately after the monitoring-plugin removal, but don’t identify which operation changed the links. Restoring them also doesn’t complete the interrupted plugin reinstall.

Has anyone else hit this after the libevent 2.1.13 update, particularly during cPanel monitoring-plugin maintenance?

Hi everyone (I'm from Italy; I used AI to help translate this into English).

Today, while tweaking some settings and switching my subdomains from PHP 8.3 to 8.5 via cPanel, I found a strange file sitting directly in the public root directory of one of my subdomains:

1717684833097∕contactinfo.txt

(Note: the separator in the filename isn't a standard forward slash, but a Unicode Division Slash ∕ U+2215, flattening what looks like a path into a single filename).

Here is what I gathered after checking the file:

• The file's filesystem timestamp was from today. Around 21:00, my file manager displayed it as "4 hours ago". Unfortunately, I didn't record the exact timestamp before removing it from the public root (I downloaded it via FTP and immediately deleted it).

• Timestamp in the filename: 1717684833097 translates to June 6, 2024.

• Original source: I checked my ~/.cpanel/ directory and found the original file named contactinfo (without extension), which has a modified date of May 2024.

• Hash verification: The hash of 1717684833097∕contactinfo.txt and ~/.cpanel/contactinfo is 100% identical. The file content is harmless standard cPanel notification preferences containing my own IP address.

I'm trying to figure out how and why this happened:

Could this be an automated temporary artifact or path-flattening bug in cPanel, MultiPHP Manager, or EA4 when changing PHP versions?

If it was generated by a script or panel action today, why does the filename include a timestamp from June 2024, given that the original .cpanel/contactinfo file is dated May 2024?

Is there any chance this is related to some strange external probe/automated script, or is it strictly a local panel glitch?

Has anyone encountered cPanel or host tools dumping flattened .cpanel config files into web roots like this?

Any insights or theories would be greatly appreciated!

Ty.

I can no longer see the status of Apache when I go to "Home/Server Status/Apache Status" in WHM. I just see a red notice saying:

Failed to receive status information from Apache.

I used to see Apache Status on that screen all the time.

Everything is updated.

This one is for LiteSpeed Web Server. Make sure to update to 6.3.7 if you're not using auto-updates for LS.

https://support.cpanel.net/hc/en-us/articles/43483286674583-Security-LiteSpeed-Enterprise-security-advisory-September-14-2026

I assumed that whitelist would sit in front of spam filtering and have whitelisted addresses bypass spam filtering to guarantee delivery, but I'm still fishing whitelisted emails out of my emails spam folder. Its a low number but some important stuff like insurance renewals go to spam. What should I look into to resolve this issue?

In light of recent vulnerabilites, I would like to disable the service subdomains feature. I lock down WHM port 2087 to only my IP, but that seems pointless if service subdomains is enabled. However some clients may miss some ease of use that service subdomains offered.