⚠️ Security Advisory: cPanel

Full info : https://support.cpanel.net/hc/en-us/articles/42285884685207-Security-GCVE-25-2026-07-45-3-Exim-forward-Privilege-Escalation

A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations.

Exim Affected Versions : Below 4.99.5

✅ Patched Versions :

11.110.0.137
11.126.0.78
11.134.0.48
11.136.0.32
138.1.6 ( WP2 )

To update your cPanel :

RcLicenseCP ; /scripts/upcp --force

To update your WP2 :

RcLicenseWP ; /scripts/upcp --force

🔺 OVSwrap

⚠️ Security Advisory:
* Enterprise Linux (EL) 9 and 10: Whole family lineage.
* CloudLinux: Versions 9, 10, and CloudLinux for Ubuntu.
* Ubuntu and Debian: Several specific releases utilizing vulnerable upstream kernel Open vSwitch action validation logic. (Like Ubuntu 22.04 Kernel 5.15)

Blog update from CloudLinux : https://blog.cloudlinux.com/ovswrap-cve-2026-64531-mitigation/

OVSwrap (CVE-2026-64531) is a vulnerability in the Linux kernel’s Open vSwitch action validation that lets any local unprivileged user become root

is my server at risk ?
run :

ls /lib/modules/$(uname -r)/kernel/net/openvswitch/openvswitch.ko* 2>/dev/null

If it prints a path, openvswitch.ko is loadable on that server and an unprivileged user can make the kernel load it on demand. Apply the mitigation below.

If it prints nothing, the module is not present for your running kernel. A later kernel update can bring it back, so run the check again after you update.
more info : https://blog.cloudlinux.com/ovswrap-cve-2026-64531-mitigation/#am-i-exposed

Mitigation before KernelCare update release :

Block the module from loading :

echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf

This takes effect immediately, needs no reboot, and touches nothing else on the server.
If the module is already loaded on a server that does not use it, unload it as well:

lsmod | grep -E '^openvswitch'
modprobe -r openvswitch

more info : https://blog.cloudlinux.com/ovswrap-cve-2026-64531-mitigation/#is-there-a-mitigation

KernelCare livepatches for OVSwrap are in preparation for the affected Linux families. Once released to the main feed, subscribed servers receive the patch automatically on the next update cycle.