Developers are shipping applications faster with AI coding assistants. Small businesses expect AI-assisted website creation. Agencies want to launch client projects in minutes instead of hours. Every one of these expectations eventually lands on a hosting provider’s support desk and infrastructure, whether or not the provider had a hand in building the site.

Hosting platforms need to evolve to meet that demand at the infrastructure level.

cPanel AI introduces a new generation of capabilities built directly into cPanel & WHM that hosting providers can offer as part of their own service: AI-assisted website provisioning, contextual support, application deployment, and secure AI-to-infrastructure connectivity. cPanel AI extends the hosting workflows providers already run, giving their customers faster ways to get online while keeping the provider in full administrative control of the environment.

Why the Web Hosting Landscape is Shifting

AI is no longer just generating copy or drafting emails; it has become an integral engine across the entire digital lifecycle, from initial development through long-term server operations.

Key trends driving this industry evolution include:

These trends are also measurable across the cPanel ecosystem.

Since January 2026, Node.js domains running on cPanel servers have increased by 35%, reflecting growing adoption of modern application runtimes alongside traditional PHP-based websites.

As AI lowers the barrier to building software, hosting providers need infrastructure that supports a broader range of application types while maintaining the reliability, security, and operational efficiency their business depends on.

Bringing Modern AI Workflows Directly to cPanel

Hosting providers reported a need for simpler provisioning, faster deployment pipelines, and more efficient support workflows, along with granular control over how AI interacts with their infrastructure. Those requirements shaped the architecture of cPanel AI.

Over the past several months, cPanel gathered input from hosting providers, system administrators, agencies, and developers operating production cPanel environments. That input reinforced findings from the 2025 cPanel Survey: the underlying technology is changing quickly, but the core operational challenges (provisioning speed, deployment complexity, and support load) remain consistent.

cPanel AI is a set of capabilities built directly into the cPanel & WHM stack that automate provisioning, accelerate deployment, and streamline infrastructure management, while keeping the provider in control of how AI operates within their environment. Here is a technical overview of what’s coming.

Meridian

Meridian is a redesigned cPanel interface architecture organized around the administrative tasks providers and their teams perform most often.

Users work from dedicated workspaces for Websites, Email, Files, Databases, Security, and Performance. Each workspace brings related capabilities together, making common hosting tasks more discoverable and workflows more efficient.

New accounts start with a guided onboarding sequence that takes an account from creation to a live website in under ten minutes, cutting down the setup questions that would otherwise land in a provider’s support queue. Returning users land on a personalized dashboard with quick access to frequently used tools, a global command palette for keyboard-driven navigation, and support for both light and dark display modes.

Meridian runs in parallel with the existing cPanel interface as an opt-in environment, so providers can migrate their operation on their own timeline without a forced cutover.

Visit the Meridian Documentation to learn more.

AI Assistant

The Integrated AI Assistant is a contextual, natural-language support layer embedded in cPanel, so account holders can resolve common questions directly instead of opening a support ticket.

Responses are grounded in cPanel’s documentation corpus and product knowledge base. The assistant explains administrative tasks, provides step-by-step remediation guidance, and analyzes available account telemetry to help diagnose operational issues, including email delivery failures, DNS misconfigurations, and other configuration errors, before they turn into a ticket in the provider’s queue.

As the platform matures, the assistant will also execute routine administrative actions following explicit user confirmation, reducing time-to-resolution on common tasks while keeping the account holder in control of what actually changes.

Visit the AI Assistant Documentation to learn more.

AI App Hosting

AI App Hosting deploys applications built outside cPanel, including those built on platforms such as Claude, Lovable, Bolt, v0, and Replit, into a production-grade hosting environment a provider already runs.

The deployment pipeline works as follows:

1. Upload a ZIP archive, connect a Git repository, or trigger deployment directly through the MCP Server.
2. cPanel provisions the runtime and applies deployment defaults.
3. The application deploys to a live URL.

This pipeline runs without manual server configuration or a CLI-based deployment step, which means a provider can support this fast-growing category of AI-generated applications without retraining a support team on every AI coding platform that produced them.

Applications built inside cPanel and applications built in an external AI development environment run on the same underlying hosting infrastructure, with no separate stack to provision or maintain.

MCP Server

As organizations manage larger hosting environments, AI needs a secure way to interact with infrastructure.

The MCP Server is a secure connection layer that lets AI agents interact with one or more cPanel servers through scoped, permissioned access the provider controls. As hosting environments scale, this gives AI systems a governed, auditable integration path into infrastructure instead of broad, unscoped access.

Through a single integration point, a provider can query infrastructure state, retrieve server metadata, monitor service status, and execute approved actions.

Permission boundaries, least-privilege access controls, and audit logging give administrators complete visibility into what each AI agent can access and every action it performs.

Visit the MCP Documentation to learn more.

Nova

Nova is an agentic website and application builder that hosting providers can offer as part of their own service, generating and deploying projects directly from natural-language prompts on the provider’s infrastructure.

A user describes the project in plain language, and Nova generates the codebase, provisions the hosting account, and deploys the result directly to the cPanel server it runs on. The whole pipeline runs inside that hosting environment, so there’s no third-party deployment tool pulling traffic somewhere else.

Nova is exposed at every point where new projects start: onboarding, website creation, and application deployment.

Nova is currently available only to cPanel Partners.

Nova for WordPress

Nova for WordPress is an AI-assisted site generator built for WordPress, the most widely deployed CMS in the cPanel ecosystem.

A user describes the website they want, and Nova for WordPress generates a complete WordPress instance and deploys it directly to the cPanel server. The instance is built on the standard WordPress editor, so anyone editing it afterward, including the provider’s support team, is working in familiar territory.

This shortens time-to-launch for a business site, a personal project, or a client build, without changing the WordPress workflow a provider already supports. Nova for WordPress currently available only to cPanel Partners.

Sitejet AI

Sitejet AI is a streamlined website generation workflow for anyone who needs a production-ready draft quickly.

A user describes a business in a sentence or two, and Sitejet AI generates a complete first draft that opens directly in Sitejet Builder for refinement and publishing. From there, the draft can be customized and published inside the same hosting environment it was generated on.

cPanel has evolved alongside the technologies that define the web throughout its product history. Across each release cycle, from supporting new application frameworks to advancing security, automation, and management tooling, cPanel has focused on giving hosting providers the tools to operate efficiently and compete effectively.

cPanel AI represents the next iteration of that evolution. By combining automation, AI-assisted workflows, and intelligent infrastructure management, cPanel is building the capability set providers need to support the next wave of hosted applications and businesses, delivered through the provider’s own platform.

cPanel will continue gathering input from providers, watching how platforms actually get used, and shipping updates that help providers keep pace as the underlying technology shifts.

Visit the Sitejet Builder Documentation to learn more.

Frequently Asked Questions

What are the primary capabilities included in cPanel AI? cPanel AI introduces an updated user interface, an AI support assistant, streamlined AI app deployment pipelines, secure infrastructure connectors, and AI-powered site-building tools directly within the cPanel & WHM environment.

How does cPanel AI handle deployment for modern AI applications? cPanel AI provides a smooth transition layer from AI development tools straight to hosting infrastructure, allowing application builds to be hosted and managed securely without complex manual setup steps.

Does cPanel AI compromise server control or administration? No. cPanel AI operates through a secure AI-to-infrastructure connection layer that respects existing administrative privileges, safety rules, and server configurations.

Stay tuned

Visit our Release Notes for additional technical details and follow for more as cPanel AI moves toward general availability.

Want to be among the first to learn more? Sign up for updates, and we will keep you informed as we announce new capabilities, previews, and availability information.

The post cPanel AI: The Next Evolution of the Control Panel​ appeared first on cPanel.

We’ve gone through every section of the data, from the feature votes and open-text comments to the AI capability questions and satisfaction ratings, and we’re sharing the full picture here.

Some of what you’ll read below is also a preview of a broader shift already underway inside cPanel & WHM: a more modern interface and a rebuilt security layer are already in progress, and an AI assistant built for the way server admins actually work is on the roadmap as a direct result of this feedback. This survey is the foundation that shift is built on.

Want more direct input into what we build next? Sign up for our UX program and help shape features before they ship.

Survey Audience

The 2025 survey drew 3,300 completed responses from across the cPanel & WHM user base, representing a significantly broader cross-section of the community. 

Most respondents are long-tenure users: 92.7% have been using cPanel & WHM for years, with only 2.39% considering it for the first time. This is a survey of people who know the product well, which makes the feedback more meaningful. 

Here are the different segments of the survey respondents by business type: 

Many respondents hold multiple roles simultaneously, with common overlaps between IT Directors and System Admins, and between CTOs and IT Directors. These are the people responsible for running hosting infrastructure day to day, often across multiple servers and customer accounts. 

An additional 842 respondents indicated they are open to speaking directly with our Product Managers about the improvements they want to see in 2026. 

Overall Satisfaction: NPS Score 

The average NPS rating for cPanel & WHM 2025 changes came in at 28, with the following breakdown: 

• Promoters: 45.9% 

• Passives: 36.3% 

• Detractors: 17.8% 

An NPS of 28 in a mature infrastructure product is a meaningful signal. Nearly half of our user base are active promoters. At the same time, the open-text responses make clear that there is real pressure on perceived value, and we’re addressing that directly later in this post. 

Most Valued Features Delivered in 2025 

We asked respondents to identify which updates delivered during 2025 they found most valuable. The results reflect a user base that values platform stability, compatibility, and performance at the core layer. 

Here are the top 5 valued changes by percentage of respondents selecting each: 

EasyApache 4 updates leading with over half of all respondents selecting them is a clear signal: the hosting stack’s PHP, Apache, and extension layer is where operational reliability lives for most providers. That’s where we invested, and it registered. 

WP Toolkit appearing in the top five confirms what the broader hosting data also shows: WordPress management has moved from a nice-to-have into a core operational requirement for providers across all segments. 

Top Requested Features for 2026 and Beyond 

Respondents were asked to identify the features they most want to see built into cPanel & WHM. Here are the 12 most-requested features by response volume: 

A few things stand out here. 

The Native Firewall Manager is the clear priority signal 

At 46.3%, it outranked every other request by a significant margin. The discontinuation of ConfigServer Firewall (CSF) left a real gap in the security stack, and many administrators are still running unmaintained installs while waiting for a native replacement. This is operationally urgent for a meaningful segment of our user base, and it’s why the WebPros Shield project is currently in progress, targeting H2 2026. 

Security and performance advisory ranked second 

Providers want the panel to proactively surface issues before they become incidents. A unified advisor available across cPanel and WHM is in definition phase now, targeting Q4 2026. 

Backup management ranked third 

The absence of a native incremental backup system has been a recurring pain point. Comet Backup integration into cPanel and WHM is actively in progress, targeting Q3 2026. 

Webmail is on the horizon soon 

Roundcube is consistently described as outdated relative to what end users now expect from an email client. Business Email integration is currently in definition, targeting Q3 2026. 

For the full status of these requests and where they sit on the roadmap, visit: features.cpanel.net.

AI in cPanel & WHM: What Users Actually Want 

AI was one of the most active sections of the entire survey, and it’s a clear preview of where cPanel & WHM is headed next. We dedicated a full section to it, specifically asking which AI capabilities users want built into the panel, and received 1,727 responses to that question alone, one of the highest response volumes of any section in the survey.

The results break down into nine clear categories:

A strong pattern emerges across nearly every category: this isn’t a user base asking for AI as a gimmick. It’s a user base asking for AI that acts like an experienced sysadmin looking over their shoulder, catching what a human would eventually catch, but faster and around the clock.

The single most-requested capability, by a wide margin, is an AI assistant that reads server logs, identifies the source of a problem, and explains what to do about it. They want the kind of tool that turns a 2am log dive into a clear next step. Resource diagnostics, security anomaly detection, and automated spam filtering follow the same logic: respondents want AI that’s useful, contextual, and actionable, not a feature for its own sake.

What ties all of these together is specificity. Respondents are describing an AI layer that is contextual to their server, actionable in the moment, and integrated directly into the workflows they already use, not a separate destination they have to remember to check.

We take the caution in the data just as seriously as the enthusiasm. 57 respondents (3.3%) explicitly oppose AI integration, primarily citing concerns about data privacy, additional cost, and forced feature adoption. That feedback is shaping the implementation as much as the demand is: everything we build here will be opt-in, transparent about what data it touches, and designed so that providers who want nothing to do with it can simply ignore it entirely.

One quote from the open-text responses captures the prevailing mood well:

“Give us a real AI assistant that reads logs, spots problems, and tells me what to do. That I’d pay for.”

That’s exactly the brief we’re building to. An AI Support Assistant in the GUI, grounded in real log data and real server context rather than generic suggestions, is currently in scope for Q3 2026, and it’s one of the pieces of the broader platform transformation we’re most energized about.

What the Open-Text Responses Tell Us 

Beyond the structured questions, we received over 4,100 open-text responses across three separate questions: 

• “If you could change one thing about cPanel & WHM” 

• “Which modern AI features would you like to see integrated?” 

• “What can we do to improve the rating you set?” 

We analyzed all of them. Here’s what the data says. 

The UI is getting attention 

The second-largest category in the “one thing to change” responses is UI and UX modernization, at 15.5% of answers. Dark mode is the single most-requested cosmetic change, and feedback on the WHM sidebar navigation, mobile responsiveness, and task efficiency appears consistently across responses. 

That work is already underway. We’re introducing Meridian, a fully revamped end-user interface that replaces Jupiter’s grid of 100+ tools with goal-oriented navigation organized around six areas: 

• Websites 

• Email 

• Files 

• Databases 

• Security 

• Performance 

Meridian ships as an opt-in theme alongside Jupiter and updates on its own cadence, so providers can manage rollout on their schedule. 

A native firewall is coming 

Security and firewall concerns account for 7.5% of the “one thing to change” responses and 6.6% of the improvement suggestions. Administrators want a native, maintained solution built into the panel itself, and that is exactly what we’re delivering. The Native Firewall Manager is our top-ranked feature request and our top development priority. We’re committed to closing this gap. 

Back to core 

A segment of respondents expressed that they want cPanel & WHM to stay focused on what it does best: reliable, precise server management. That feedback is noted. Our goal for 2026 is to ship meaningful improvements to the core platform, including security, backups, email, performance visibility, and let that work speak for itself. 

What is working 

145 respondents indicated no desired changes or expressed direct satisfaction with the product. That’s 7.7% of the “one thing to change” responses, and it’s an important signal. The core platform, the WHM management layer, the integration ecosystem, and the overall reliability of cPanel-powered environments are consistently praised. The areas of frustration are specific and addressable, and that’s exactly the kind of feedback we can act on. 

What We’re Building in 2026 

The survey results confirmed our priorities. The three areas with the strongest demand signal are all actively in development. A native firewall manager and brute-force protection layer is currently being built to replace the gap left by CSF. 

Improved backup management, including incremental backup support via Comet Backup integration, is in progress. And a unified Security and Performance Advisor, surfacing proactive recommendations directly inside the panel rather than requiring administrators to hunt for issues, is in definition now. 

Beyond security and reliability, the feedback on email, AI, and the broader user experience is shaping what comes next. Business Email integration, which will be a meaningful upgrade to the webmail experience that end users have long needed, is on track. 

An AI Support Assistant built into the GUI, focused on the practical, log-reading and diagnostic use cases that respondents asked for specifically, is also scheduled. We’re approaching AI capability the way the survey asked us to: opt-in, operationally useful, and grounded in actual server management workflows rather than generative features added for their own sake. 

For the full picture of what’s planned, in progress, and under consideration, the roadmap is live at features.cpanel.net. 

Thank You 

3,300 responses is a meaningful commitment of time from people. We genuinely appreciate every one of them. 

The goal of this survey is to make better decisions about what we build, and the 2025 data gives us a clearer signal than we’ve had before. The priorities are not ambiguous: security tooling, backup management, email modernization, a more responsive UI, and AI that earns its place by solving real operational problems. 

We’ll share updates as work progresses. If you want to go deeper on any of the roadmap items, or if you’re one of the 842 respondents who opted in to speak with a Product Manager, watch your inbox. 

Want a more direct hand in what we build next? Sign up for our UX program and help test new features before they ship.

For the current roadmap: features.cpanel.net. 

The post cPanel & WHM 2025 Survey Results: What 3,300 of You Told Us appeared first on cPanel.

AI Is the #1 Panel Innovation Gap

According to the report, when hosting providers were asked where control panels should innovate most, 36% chose integrated AI and automation tools. That ranked ahead of advanced security and compliance (19%), better WordPress and CMS integrations (17%), centralized server and license management (15%), and developer tools and API access (6%). AI and automation outranked every other category combined.

In the next 2-3 years, where do you see the BIGGEST innovation opportunities, for control panels and web infrastructure software?

For a mid-sized provider, this data point matters because it reflects what the market expects from the platforms you operate on. The providers evaluating and purchasing control panels are increasingly making those decisions based on whether AI is embedded in the platform itself.

Where Providers Are With AI Today

The report shows that AI adoption in hosting operations is real but still early: 36% already use AI in customer support, primarily through chatbots and reply suggestions. 30% use AI for server monitoring and optimization, including anomaly detection and smart alerting. 29% deploy AI for cybersecurity threat detection. 27% have not implemented any AI solutions yet. 

In which areas have you already implemented AI solutions successfully in your operations?

The providers who have started concentrated their initial efforts in support, security, and monitoring, the three areas where operational pressure is highest and the return on automation is most immediate. More than a quarter of the industry has not started at all, which means the competitive window for early adopters is still open. 

The Operational Pressure Driving AI Demand

The AI demand data maps directly to where hosting teams are spending the most time and absorbing the most cost. 

The report identifies the four largest consumers of support time across the industry: email problems including spam, blacklisting, and deliverability (42%), CMS and application issues such as plugin conflicts and installation help (39%), performance issues including slow sites (35%), and security incidents including hacked sites and malware (35%). 

Which of the following topics consume the most support time on a regular basis?

On the security side specifically, 53% of providers cite outdated software and plugins as their biggest security challenge. 51% deal with malware and ransomware. 40% face DDoS attacks. 36% report bot traffic consuming server resources. 

These are not edge cases. They are the daily operational reality for the majority of hosting providers, and every one of them is a candidate for AI-assisted automation built directly into the control panel. 

What Providers Want AI to Do Inside Their Panel

When asked which AI capabilities would create the most value for their business, providers gave operationally grounded answers: automated security and malware detection (65%), predictive server performance monitoring (48%), AI-driven customer support tools (37%), AI-assisted onboarding and migrations (23%), and billing anomaly detection (19%). 

The top two requests are both about catching problems before they reach the customer. Providers are not asking for AI to do new things. They are asking for AI to handle the problems they already manage manually, but earlier, faster, and more consistently. 

Which of the following AI-enabled capabilities would create the most value for your business?

65% want automated malware detection because 53% are dealing with outdated plugin vulnerabilities and 51% with malware. 48% want predictive performance monitoring because 35% of support time goes to slow site issues. 37% want AI-driven support tools because routine queries consume team capacity that could go toward complex issues. 

The connection between where support time goes and where providers want AI deployed inside the panel is the clearest signal in the data about where to start. 

What cPanel Is Building

The specific AI capabilities currently in development at cPanel are designed to address the support and troubleshooting patterns the survey identifies. The details are covered in this overview of AI features coming to cPanel, but the two core capabilities worth understanding are: 

An embedded AI support assistant that lives inside the cPanel interface. Users can ask questions in plain language and receive contextual guidance, step-by-step workflow direction, and relevant documentation without opening a support ticket. For providers, this means fewer repetitive tickets reaching the support queue and a more consistent experience for end users. 

MCP-based troubleshooting integration that enables AI systems to interact with cPanel through a structured protocol. In practice, that means instead of manually checking Apache error logs, PHP configuration, DNS resolution, and file permissions when a site returns a 500 error, an AI-assisted workflow can check those in sequence and surface the likely cause.

Diagnostic workflows become standardized across environments, common issues get identified with less manual effort, and the time per investigation drops. For a mid-sized provider where different team members diagnose the same issue differently, that consistency has direct operational value. 

Which of the following security challenges create the most operational overhead or risk for your business?

Both capabilities work within existing permission models and administrative controls, which matters for providers managing multi-tenant environments. The effectiveness of these AI capabilities will also grow as the platform deepens its awareness of the application layer, particularly CMS environments, given that 39% of support tickets originate there.

The more context AI has about what is running inside a server, the more accurately it can diagnose issues and reduce the support burden that sits in the application layer today. 

What This Means if You Run cPanel

The survey data and the AI capabilities in development connect to specific operational realities that cPanel users deal with daily. Here is how. 

The four largest support drains in the industry, email (42%), CMS issues (39%), performance (35%), and security (35%), are the same categories that generate the highest ticket volume for cPanel-based hosting operations. The embedded AI support assistant is designed to intercept the routine queries within those categories before they become tickets.

When an end user asks “how do I create an email account,” “why is my website not loading,” or “where do I manage my DNS settings,” the assistant provides contextual, step-by-step guidance inside the interface rather than routing that question to your support team. For a provider handling hundreds of accounts, even a partial reduction in routine ticket volume translates directly into recovered team capacity. 

The MCP troubleshooting integration changes how your support team investigates issues. Today, diagnosing a 500 error typically means a support engineer manually reviewing Apache error logs, checking PHP configuration, verifying DNS resolution, inspecting file permissions, and piecing together a root cause across multiple tools and log files. Different team members approach that investigation differently, which creates inconsistency in resolution time and quality.

MCP standardizes that sequence. An AI-assisted workflow checks each diagnostic step in order and surfaces the probable cause, giving your team a consistent starting point for every investigation regardless of who picks up the ticket. For a team of five to fifteen people managing a growing fleet, that consistency compounds into a meaningful operational improvement over time. 

48% of providers want predictive performance monitoring, and the diagnostic infrastructure being built through MCP creates a natural foundation for that capability. The same structured access to server-level data that enables faster troubleshooting also generates the historical patterns needed to identify degradation before it produces incidents.

For a mid-sized provider, the operational value is direct: a performance issue on a shared server affects multiple customers simultaneously, generating a cluster of tickets that a lean team has to resolve under pressure. Catching the early signals of resource exhaustion, abnormal I/O patterns, or application-level slowdowns before they reach the customer is the difference between proactive service delivery and reactive firefighting. 

Both capabilities are in active development, and providers can influence what gets built through the cPanel feature request portal. In the meantime, there are things worth doing now that position your team to adopt these tools with minimal friction when they become available. Documenting the ten most common support scenarios your team handles, including the exact diagnostic steps and resolution paths, creates an internal knowledge base that reduces variation today and becomes the foundation for AI-assisted workflows when they arrive.

Standardizing how your team approaches recurring issue categories, particularly around email configuration, WordPress troubleshooting, and performance investigation, means the transition to AI-assisted diagnostics is a refinement of existing processes rather than a new way of working. 

84% of providers rank automation among their top factors when evaluating server software, with 55% selecting the highest possible rating. AI builds on that automation foundation by handling the variable, unpredictable workflows that automation alone cannot address: identifying which server is trending toward resource exhaustion, identifying which customer site is running components with known vulnerabilities, identifying which support ticket can be resolved through guided self-service rather than human investigation. The support drain data tells you where to look first. The AI capability demand data tells you what comes next. 

From Operational Efficiency to Competitive Advantage

53% of providers expect AI-driven automation to have the biggest impact on hosting in the period ahead. The providers who will compete most effectively are those who build AI into their operations one use case at a time, starting where the data shows the most pain, and measuring the return clearly enough to justify the next step.

Which of these trends do you anticipate having the biggest impact on the hosting industry in 2026?

At cPanel, that is the framing shaping how the platform continues to evolve: helping providers manage infrastructure more intelligently, at the scale and complexity modern hosting demands.

The post From Automation to Intelligence: What Hosting Providers Expect from AI appeared first on cPanel.

This release focuses on streamlining certificate lifecycle management, simplifying day-to-day server administration, and improving visibility and control across hosting environments.

Top Release Highlights

Strengthening Security With Integrated Firewall Management

ConfigServer Security & Firewall (CSF) is now delivered through cPanel’s signed update pipeline, replacing the previous Web2Web distribution method. Existing CSF installations are automatically migrated, and Security Advisor now recommends cPanel-managed CSF when it is not installed.

This change ensures firewall updates are verified, consistent, and seamlessly integrated into standard cPanel updates. By removing the need to manage external update sources, teams can maintain a more consistent security posture across their environments. Teams should verify that CSF is active and managed via cPanel across their servers.

Preparing for the Future of SSL

Industry standards for SSL/TLS certificates are evolving, with certificate lifespans expected to decrease significantly over time.

cPanel & WHM v136 introduces native support for short-lived SSL certificates, with automated issuance and renewal via the ACME protocol. This applies across all SSL types, including paid certificates.

With automation handling frequent renewals, teams can manage certificate lifecycles more reliably while reducing the risk of unexpected expirations. Review your SSL configuration to ensure ACME-based automation is enabled where applicable.

Simplifying SSL Management

SSL management in cPanel is now more streamlined. Three separate SSL-related interfaces have been consolidated into a single unified SSL/TLS management page.

This reduces navigation friction, simplifies certificate workflows, and helps minimize configuration errors for end users. Update any internal processes or documentation that reference the previous SSL interface.

Improving Visibility and Control Across Server Environments

Several updates in v136 focus on making server management more consistent and easier to operate at scale.

Server-Wide PHP Error logging

Administrators can now configure PHP error logging across all accounts from a single WHM interface. This enables consistent logging configurations and supports faster troubleshooting across environments. Review and standardize your PHP logging settings at the server level.

Enhanced Log Retention Controls

New controls in WHM and cPanel provide greater visibility into web server log storage and lifecycle. This helps teams manage disk usage more effectively while aligning with logging and compliance requirements. Audit your current log retention settings and adjust them based on your storage and compliance needs.

Improved PHP Version Visibility

End-of-Life (EOL) and Hardened PHP versions are now clearly distinguished in the interface. This makes it easier to identify unsupported versions and prioritize upgrades based on risk. Review your servers for EOL PHP versions and plan upgrades where necessary.

MariaDB 11.8 support

MariaDB® 11.8 is now supported and available as an option in WHM’s Upgrade Database Version interface.

This gives teams more flexibility when managing database versions and planning upgrades across their environments. Review your current database versions and plan upgrades where appropriate.

Strengthening Session Security

Logging out via WebPros Account now fully terminates the global SSO session, rather than only ending the local cPanel or WHM session.

This aligns logout behavior with expected SSO standards and reduces the risk of lingering authenticated sessions.

Platform Updates: Final Support for Ubuntu 22.04 LTS

cPanel & WHM v136 is the last version to support Ubuntu 22.04 LTS. Customers currently running Ubuntu 22.04 should plan and initiate migration to Ubuntu 24.04 LTS using the ELevate upgrade path before upgrading beyond this release.

cPanel & WHM v136 supports:

• AlmaLinux 8, 9, and 10
• CloudLinux 8, 9, and 10
• Ubuntu 24.04 LTS

Built for More Consistent, Scalable Operations

cPanel & WHM v136 brings together improvements that make it easier to operate, secure, and scale hosting environments.

By integrating security updates, automating high-frequency tasks like SSL renewal, and centralizing configuration management, this release helps reduce manual work while improving consistency across systems.

Learn More

For full technical details, review the complete v136 release notes.

The post Introducing cPanel & WHM Version 136 appeared first on cPanel.

Once a verified and reproducible report was confirmed, our team made updates available within approximately 28 hours across all supported versions of the platform, as well as select legacy versions. As of today, over 98% of servers worldwide are running an updated version of cPanel & WHM. We continue to provide mitigation options for partners and customers who are unable to apply the update immediately. The complete update regarding patch coverage is listed in the following support article. 

We take security extremely seriously and recognize the urgency this created. We remain focused on supporting our partners and customers. 

What Was Addressed 

CVE-2026-41940 is an authentication vulnerability in cPanel & WHM’s session management layer. Two separate code paths write to session files on disk: one path included an input-sanitisation step; a second path, invoked during Basic authentication handling, did not. The absence of that sanitisation step on the second path created a condition under which a specially crafted request could result in an unauthenticated session being treated as authenticated, granting access without valid credentials. 

The vulnerability affects every version of cPanel & WHM after v11.40, and WP Squared up to v11.136.1.6. VulnCheck has assigned it a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 1 May 2026. No other WebPros products are affected.

For servers on versions that cannot yet be updated, the support article provides mitigation guidance including cpsrvd service port blocking and ModSecurity rule application. We have also published a detection script  that scans session files for the indicators of compromise associated with this attack. Note that, as of 1 May 2026, the script has been refined to remove an earlier false-positive on session.lock files.

How We Responded 

The following sequence reflects how the response unfolded on confirming the vulnerability. 

• 27 April, 10:47 CDT – Vulnerability confirmed and classified. Incident response initiated

• 28 April, 12:08 CDT – Support article (KB 40073787579671) published. Partner collaboration channels opened

• 28 April, 12:30 CDT – Code update merged into v138 and applied simultaneously across v136, v134, v126, v118, and v110

• 28 April, 16:19 CDT – Updated builds published across all supported tiers: LTS, STABLE, RELEASE, CURRENT, and EDGE. Approximately 28 hours from confirmation to general availability 

• 29 April 15:18 CDT – Comprehensive email issued to all partners and direct customers, alongside publication of the indicators-of-compromise detection script. A second coordinated email followed on 1 May with expanded version coverage and additional mitigation measures

From there, the work continued in parallel: back-ports for legacy and end-of-life versions, automated remediation tooling, and direct support for partners working through specific fleet configurations.  

Detection and Auto-Remediation Tooling

Two additional tools supported the broader response alongside the patches. 

The indicators-of-compromise detection script, available at https://support.cpanel.net/hc/en-us/articles/40073787579671 scans session files for attributes associated with this specific exploit. It was refined on 1 May to correct a false-positive on session.lock files identified by partners during their own fleet testing. Any server that was unpatched at any point during the incident window should be scanned using the current version of the script. 

Automated remediation tooling was deployed on our side to accelerate update adoption across the installed base, including a majority of affected builds, a number of end-of-life versions and a dedicated path for CL6/C6 environments accessible via run_security_update. This allowed us to drive patch coverage to over 98% of servers as of today without requiring manual intervention across every affected configuration. Coverage continues to expand through specific mitigation steps outlined in our support article. 

Updates for Legacy Versions  

In addition to all currently supported tiers, we delivered targeted updates for v86, v94, v102, v124, and v130, which have been outside standard support for some time, along with a dedicated update tier for CL6/C6 (CloudLinux 6) environments, available through the run_security_update autofixer.

Each of these required individual engineering work: targeted porting, version-specific validation, and full regression testing before release. 

Working Closely with Partners on Edge Cases 

The update coverage we can report today was built alongside our partners, not independently of them. Over the past week, hosting partners and server administrators have been active participants in the response, and we want to be specific about what that looked like. 

Testing the Detection Script Against Live Fleets 

Several partners ran the detection script across their server fleets in the days after publication and reported edge cases that had not surfaced in our own testing environment. This partner feedback is what produced the 1 May update to the script. Their environments effectively extended our validation coverage in ways that improved the quality of the tooling for everyone. 

Validating Update Behaviour on Non-Standard Configurations 

Pinned, locked, and version-restricted configurations do not always behave the way standard configurations do when an update runs. Partners with these environments worked directly alongside our engineering team to validate tooling behaviour against their specific setups, and to surface update blockers before broader rollout. Several of the back-ports for older version tiers were shaped directly by these conversations: partners described exactly what their fleet was running and why it could not move, and our team built the update path around that constraint. 

Coordinating Customer Communications 

A number of partners aligned their own customer communications with ours, requesting accuracy checks, version-specific guidance, and technical detail they could relay to their support teams. We supported each of these requests directly. The result was a more consistent message reaching downstream customers across a wide range of hosting environments. 

Surfacing Partner-Specific Update Blockers 

In several cases, partners identified conditions specific to their environment that prevented the standard update path from completing and brought them to our attention directly. Our team prioritised each one as part of the incident response rather than routing it through standard support. That prioritisation contributed directly to the pace at which update coverage moved. 

Further Context

During the course of April, we received separate reports regarding a possible pre-authentication issue in cPanel & WHM. For one of the two reports, our team engaged in follow-up correspondence with the person behind it to better understand, categorize and clarify the information provided. With the details available at that stage, we were unable to independently reproduce the reported behavior, and our initial assessment did not confirm a vulnerability. When the second report arrived with additional context, our team was able to reproduce and confirm the vulnerability the same day, and our incident response protocol began immediately.

What We Are Changing 

The following commitments reflect our focus on continuous improvements in security practices, to address an evolving threat landscape. 

Thank You 

Our customers, our partners and their customers, depend on this infrastructure, and that dependency carries a responsibility we take seriously. Our response has been to fix first, move quickly, provide clear and actionable communication, and commit to a continuous improvement in our processes to address a fast-changing threat landscape.  

To the partners who worked alongside our team this past week, testing tooling, working through non-standard configurations, aligning customer communications, and flagging issues as they found them: the update coverage we have achieved is a direct result of that collaboration. Thank you.

To the security community whose scrutiny has kept this incident in clear focus: that scrutiny is appropriate and it produces better outcomes. Thank you.

The support article at https://support.cpanel.net/hc/en-us/articles/40073787579671 remains the live operational reference and is updated continuously.

The post CVE-2026-41940: Response, Actions and Next Steps appeared first on cPanel.

Infrastructure is more complex. Support demands are higher. Users expect faster answers and more intuitive experiences. Yet most hosting workflows still rely on fragmented tools, manual troubleshooting, and reactive support models.

That model no longer scales.

cPanel is redefining the role of the hosting control panel, evolving it into an intelligent operations layer where assistance, troubleshooting, and system insight are built directly into the platform. This shift is not about adding AI features. It’s about embedding intelligence into the core of how hosting environments are managed.

According to the Web Hosting Trends Report 2026 by WebPros and CloudLinux, providers are increasingly prioritizing AI-driven tools to reduce operational overhead and improve support efficiency. cPanel is taking this a step further by integrating those capabilities directly into the control plane itself, where decisions are made and actions happen.

Core AI Capabilities in cPanel

cPanel is introducing a new layer of AI-powered capabilities designed to fundamentally change how hosting environments are operated and supported at scale.

Instead of relying on external tools, documentation, or manual investigation, users can now interact with their environments in real time, getting answers, guidance, and diagnostics directly within cPanel. At a practical level, this means:

• Instant, contextual answers without leaving the interface
• Guided workflows for common and complex tasks
• Faster, more accurate issue identification
• Standardized, repeatable troubleshooting processes

Together, these capabilities reduce the time and effort required to manage hosting environments, while improving consistency across users, teams, and infrastructure.

This new model is powered by two core innovations:

• An embedded AI assistant, designed to guide users and reduce dependency on support
• Context-aware troubleshooting through MCP, enabling structured, scalable diagnostics across environments

These are not standalone features. They represent the foundation of a broader shift toward intelligent, self-service hosting operations, built directly into cPanel.

AI-Powered In-Product Assistant

One of the most impactful enhancements planned in the roadmap is an embedded AI support experience directly within cPanel.

Ask Questions in Plain Language

This in-product support assistant helps users navigate tasks, resolve issues, and understand features without leaving the interface. Instead of relying on trial and error, users can simply ask questions in plain language, such as:

• How do I create an email account?
• Why is my website not loading?
• Where can I manage my domain settings?

For example, a user troubleshooting a website issue can ask what’s wrong, receive a simple checklist, and navigate to the relevant tools without opening a support ticket.

Step-by-Step Guidance Inside the Interface

The assistant responds with clear, contextual guidance, often pointing directly to the relevant tools or walking users through the next steps.

In its initial iterations, the focus is on:

• Answering “how-to” questions
• Guiding users through common workflows
• Helping troubleshoot basic issues
• Surfacing relevant documentation and tools

Reduced Dependency on Support

This means faster onboarding and less friction when using advanced features. For hosting providers, it helps reduce repetitive support requests and creates a more consistent support experience across customers.

As capabilities evolve, this assistant is expected to become a core part of how users interact with cPanel, making everyday hosting tasks simpler and more intuitive.

Context-Aware Troubleshooting with MCP

While the in-product assistant improves how users interact with cPanel, MCP integration improves how issues are diagnosed behind the scenes.

Faster Diagnostics with Context-Aware AI

MCP enables AI systems to interact with cPanel through a structured, standardized protocol, allowing consistent and repeatable troubleshooting workflows across environments.

This means:

• Logs and configurations can be reviewed faster
• Common issues can be identified with less manual effort
• Troubleshooting steps can be more consistent and repeatable

For example, instead of manually checking multiple systems, an AI-assisted workflow could help surface why a site is returning an error, highlighting potential causes, and suggesting the next steps to resolve it.

More Consistent Troubleshooting Workflows

For server admins and support teams, this reduces the time spent on routine investigations and helps standardize how issues are handled across environments.

Importantly, these capabilities are designed to operate within existing permission models and administrative controls. As with any system-level access, actions depend on the level of access granted. AI can assist with managing environments, but it operates with the same scope and responsibilities as the user or admin it represents. This means oversight remains critical, especially as AI-assisted workflows continue to evolve.

Here’s how it will operate:

Together, MCP integration lays the foundation for faster, more scalable support and operations within cPanel.

What This Means for You

These capabilities are designed to deliver measurable improvements across the hosting ecosystem.

For Hosting Providers

Greater operational scalability through reduced support volume and more efficient issue resolution.

For Server Admins

Faster diagnostics and reduced cognitive load when investigating issues across complex environments.

Across all users, the outcome is the same: less time spent figuring things out, and more time spent getting things done.

Help Define the Next Phase of cPanel

The evolution of cPanel is not happening in isolation. Feedback from hosting providers, developers, and end users continues to play a key role in shaping what gets built next.

As these AI capabilities take shape, there is an opportunity to directly influence how they evolve, whether it is suggesting new use cases, improving existing workflows, or prioritizing specific features.

Do you have a feature in mind? Submit it or vote on existing ideas to help shape what comes next in cPanel.

Your feedback can help define the next phase of innovation in cPanel.

This is a step toward a more intelligent, more responsive cPanel experience, built around how hosting is actually used today.

The post The Next Evolution of cPanel: Built-In AI for Faster, Smarter Hosting Management appeared first on cPanel.

For hosting providers, this creates a difficult decision.

You can require customers to upgrade to a newer PHP version. But that often means code changes, compatibility issues, and the risk of breaking live websites.

Or you can allow sites to continue running on unsupported PHP versions, knowing that security patches are no longer being released.

Neither option is ideal.

Extended PHP Support (PHP ELS) for cPanel & WHM was introduced to address this exact situation. It provides security-patched builds for unsupported PHP 5.6–8.1, allowing websites to remain on their current PHP version while still receiving ongoing security fixes.

The Scale of the Problem

This is not an edge case. Across eligible cPanel servers that are not running CloudLinux OS, millions of sites still run on older PHP versions across hundreds of thousands of servers.

These are not inactive environments. They power ecommerce stores, business applications, and production workloads. For many providers, outdated PHP is deeply embedded in their customer base. Upgrading every site is not an overnight task. It often requires development effort, compatibility checks, and careful rollout planning.

In shared hosting environments, forced upgrades can quickly lead to broken applications and increased support load. At the same time, leaving PHP unpatched introduces real security risk.

This is the gap Extended PHP Support is designed to close.

What Extended PHP Support Actually Does

Extended PHP Support (PHP ELS), powered by TuxCare, is a paid, per-server add-on for cPanel & WHM. It delivers security-patched builds for unsupported PHP versions 5.6 through 8.1.

The key point: the visible PHP version does not change. A site running PHP 7.3 continues on PHP 7.3. A site on PHP 8.0 remains on PHP 8.0. There is no forced migration or automatic upgrade. Instead, the underlying PHP build is patched for security vulnerabilities.

PHP ELS is a focused, standalone solution for one specific problem: securing outdated PHP without disrupting live websites. CloudLinux OS, by comparison, is a broader security solution that also includes secured PHP as part of its wider feature set.

This creates a third path: neither forcing disruptive upgrades nor running unpatched PHP in production. It allows you to secure existing environments while planning modernization on your own timeline.

What This Means for cPanel Users

Extended PHP Support changes how you manage environments that cannot be upgraded immediately.

• Gain time without increasing risk: Keep legacy applications running while receiving security patches, instead of choosing between rushed upgrades and exposure.
• Reduce operational disruption: Avoid compatibility issues and unexpected downtime caused by forced version changes.
• Move from reactive fixes to planned modernization: Schedule migrations strategically, with proper testing and coordination.
• Make legacy support intentional: Treat extended lifecycle support as a defined part of your operations, not hidden overhead.
• Retain commercial flexibility: As a per-server add-on, you decide how and where to enable it across your services.
• Protect production workloads already in place: Secure active sites running older PHP versions without disrupting them.

Extended PHP Support introduces a controlled middle ground between forced upgrades and running unsupported PHP without security patches.

How to Enable Extended PHP Support

To enable Extended PHP Support:

Step 1: Confirm eligibility

Only servers that meet these criteria are eligible:

• Server runs cPanel & WHM v110 or later (initially introduced in v134, with backports to v110, 126, 130, and 132)
• Active paid cPanel & WHM license
• Not a Trial or DNS-Only license
• Not running CloudLinux OS

Step 2: Purchase the add-on

Purchase “Extended PHP Support (PHP ELS)” via cPanel Store or manage2 for the server’s licensed IP. Accept the TuxCare EULA.

The license is IP-based and server-wide. One license covers all PHP sites on that server.

Step 3: Install the secured PHP builds

After purchase, the secured PHP builds are installed on the server within a few minutes. Websites are not switched automatically. You can then switch sites to the secured PHP versions.

Step 4: Switch sites to secured PHP builds

In WHM (PHP Manager or EasyApache), identify sites running outdated PHP and move them to secured builds for versions 5.6–8.1.

Applications continue running on the same PHP version. Only the underlying build is patched.

Where PHP ELS Fits in Your Long-Term Roadmap

Once PHP ELS is enabled, the secured PHP builds are installed on the server. The next step is to move sites from outdated PHP versions to the secured PHP builds in WHM.

That gives you a more secure foundation without forcing an immediate version upgrade. From there, what matters is how you use that time.

Treat PHP ELS as a bridge. Use it to plan upgrades for legacy applications based on priority and effort. Track where extended support is being used. Identify clusters of legacy usage and plan modernization accordingly.

Communicate clearly with customers or internal teams. Extended support reduces risk today while upgrades are planned responsibly. Extended PHP Support gives you control, but its value depends on how intentionally you use it.

Secure what is running, plan what comes next, and move forward on your terms.

The post Keep Legacy PHP Secure with Extended Support on cPanel appeared first on cPanel.

From default-enabled SSL purchasing to extended security coverage for legacy PHP versions, v134 helps hosting providers reduce friction, modernize infrastructure, and maintain secure systems at scale.

Top Release Highlights

SSL/TLS Wizard: Now Enabled by Default

SSL certificate purchasing is now enabled by default in the SSL/TLS Wizard. WHM administrators no longer need to manually enable this capability for end users.

Users can immediately purchase and install trusted Sectigo DV, OV, and EV certificates directly through cPanel. The updated interface highlights unsecured domains and guides users through certificate setup and installation.

Administrators retain full control through WHM’s Feature Manager and can disable the feature if required.

PHP Extended Lifecycle Support (PHP ELS)

cPanel & WHM v134 introduces backend support for PHP Extended Lifecycle Support (ELS), powered by TuxCare/CloudLinux.

This service provides continued security patching for unsupported PHP releases. It enables customers running end-of-life PHP versions to remain protected while modernizing their applications.

Customers can purchase and enable PHP ELS through the cPanel Store.

Once enabled, administrators can manage supported versions through Packages with visibility in PHP Manager.

WebPros Account Integration at Installation

New WHM installations now include optional WebPros Account integration.

For qualifying retail installations, WebPros authentication appears alongside traditional login methods during setup. This provides a unified login experience across WebPros products and simplifies first-time configuration.

CalDAV and CardDAV DoS Protection

This release adds a new security setting to WHM’s Tweak Settings interface.

The Enable CalDAV/CardDAV DoS Protection option (WHM » Home » Server Configuration » Tweak Settings) helps protect CalDAV and CardDAV services from Denial-of-Service (DoS) attacks by limiting request content length and size.

This enhancement improves service resilience for environments using calendar and contact synchronization.

CloudLinux 10 Support (New)

cPanel & WHM v134 adds support for the CloudLinux 10 operating system.

This enables hosting providers to adopt the latest CloudLinux platform while maintaining full cPanel & WHM compatibility. CloudLinux 10 support represents a major platform milestone for CloudLinux-based environments.

For installation requirements and compatibility details, please review the CloudLinux system requirements documentation.

Platform Support Updates

With this release, we continue aligning cPanel & WHM with modern, secure operating systems while providing clear guidance for upcoming platform transitions.

Added Support

Added support for CloudLinux 10.

Lifecycle and Retirement Notices

• Ubuntu 22.04 LTS support will retire in version 136 (expected Q1 2026).

Customers running Ubuntu 22.04 will receive in-product guidance to upgrade to Ubuntu 24.04 LTS using ELevate. New installations on Ubuntu 22.04 will be blocked starting with v136, and systems must be upgraded before moving to v136 or later.

• Rocky Linux is no longer supported as of v134.

New installations and upgrades on Rocky Linux are blocked.

We encourage administrators to review their environments and plan platform transitions early to ensure a smooth upgrade experience.

Before You Upgrade

Please note the following upgrade requirements:

• Rocky Linux is no longer supported as of v134. New installations and upgrades on Rocky Linux are blocked.
• Customers running end-of-life PHP versions may consider enabling PHP ELS.
• Ubuntu 22.04 LTS users should begin planning migration to Ubuntu 24.04 LTS ahead of v136.

Update Now

With improved SSL accessibility, extended PHP security coverage, expanded CloudLinux compatibility, and strengthened service protections, cPanel & WHM v134 delivers meaningful updates for modern hosting environments.

For full technical details, review the complete v134 release notes.

The post Introducing cPanel & WHM Version 134 appeared first on cPanel.

Up-to-Date Systems and Security Enhancements 

Security threats are rising sharply. According to the Verizon DBIR, over 60% of breaches exploit vulnerabilities that already have patches, and reports show double-digit growth in Linux server vulnerabilities year over year. With PHP still powering over 72% of the internet, fast updates and hardened infrastructure are essential. 

In 2025, cPanel delivered continuous platform and security enhancements to keep servers safe by default. 

Key highlights of this year: 

• Expanded OS support: cPanel now runs on AlmaLinux 10 and Ubuntu 24, giving providers access to modern, secure platforms. 

• Seamless upgrades with ELevate: In-place OS upgrades are now easier, preserving Apache/PHP configurations, databases, and more. 

• Introduction of PHP 8.5: Delivered within cPanel’s 2-day SLA. 

• Weekly EasyApache updates: Included the latest PHP components, database, and mail services. Automatically applies security patches for OS, web server, and PHP modules, fixing known vulnerabilities and hardening configurations with minimal downtime. 

• Stronger WordPress security: Enhanced through WP Toolkit and WP Guardian, with automated scanning and patching of vulnerable plugins and themes, plus real-time alerts for potential threats. 

With these updates, our users can maintain secure, stable environments without disruptive migrations. 

Extended Lifecycle Support (OS and PHP) 

Many servers and websites still run outdated operating systems or legacy PHP versions, increasing security risks. Over 50% of PHP installations globally are on versions that no longer receive official security updates, and many hosting providers continue operating on OS versions past their vendor lifecycle due to the complexity and cost of migration.  

cPanel’s Extended Lifecycle Support (ELS) provides a practical solution:  

• Extended Lifecycle Support for outdated OS versions: Even after vendor end-of-life, cPanel provides continued security patches, new product releases, and full technical support. This gives providers flexibility in planning infrastructure upgrades while reducing risks of downtime or data breaches. 

• Extended Lifecycle Support for legacy PHP versions (arriving late 2025): Security fixes are backported into unsupported PHP versions using ELS PHP (powered by TuxCare/CL), allowing websites to run safely without immediate upgrades. 

With so many sites still running legacy PHP and OS versions, cPanel’s Extended Lifecycle Support helps hosting providers keep those systems safe while minimizing operational disruptions. 

Modern Web Development and AI Tools 

AI has become essential for SMBs, agencies, and developers. According to Deloitte’s SMB AI Report, 60% of small businesses expect to rely on AI for content or website creation within the next two years. Furthermore, Gartner estimates that the no-code/low-code industry continues to grow rapidly, at over 20% per year. 

cPanel expanded its web-development and AI ecosystem significantly this year to help users create sites and applications faster than ever while maintaining full control on their hosting infrastructure. 

• Sitejet AI Builder: Quickly generate websites with AI-assisted layouts and content. 

• Nova AI app builder: Build functional websites and applications through natural conversation. 

• Temporary domain support: Start building projects immediately, without waiting for a domain to be registered or propagated. This is especially useful for agencies, developers, and SMBs who want to prototype quickly, migrate existing sites without downtime, or test new features in an isolated environment. By removing the need for a domain, projects can start faster and staging becomes simpler. 

• WP Toolkit enhancements: Faster staging, improved cloning and backups, and integrated WP Guardian security features.  

• Vulnerability protection: Delivers real-time WordPress security, now included inside WP Squared and powered by Patchstack. 

• Paid cPanel images in hyperscalers: Users can utilize our paid images in all available marketplaces to launch cPanel quickly and reliably on their preferred hyperscaler. 

With these expansions, our users can build websites and apps faster and more securely, while maintaining full control over their hosting environment. 

Server Monitoring and Site Quality Monitoring 

Website performance directly impacts revenue: a 1-second slowdown can reduce conversions by 7%, and downtime can cost SMBs thousands per incident. 

Google uses performance and Core Web Vitals as ranking factors, so, cPanel strengthened its monitoring suite to help providers identify issues early, maintain uptime, and deliver better experiences. 

Enhancements in 2025: 

• 360 Monitoring: Provides deep, real-time visibility into critical server health metrics, including CPU load, memory usage, and server performance. These insights help catch resource issues before they impact customers, support capacity planning, and enable faster root-cause diagnosis during incidents. It reduces downtime, minimizes performance degradation, and allows teams to operate more proactively. 

• Site Quality Monitoring: Continuously checks websites for broken links, slow loading pages, HTTP errors, content issues, and uptime failures – problems that often go unnoticed until customers complain or rankings drop. With automated detection and alerts, providers can fix issues early, preserve SEO value, improve user experience, and demonstrate higher service quality.  

• DNS improvements: Support for TXT records over 255 characters, default DMARC records, and optimized zone management. 

Now, providers can identify issues early, maintain uptime, and deliver reliable experiences for their customers. 

SEO Improvements 

With organic search driving more than 50% of online traffic on average, cPanel continued exploring ways to support small businesses and agencies with simpler, more accessible SEO capabilities.

In 2025, cPanel began foundational work on an SEO extension powered by XOVI. The concept is to bring technical SEO and visibility insights closer to where customers manage their websites, with the long-term goal of offering actionable SEO guidance directly within cPanel and reducing reliance on separate, specialized SEO tools.

Additional UX & Quality Enhancements 

Throughout 2025, we shipped a range of updates that improved performance, reliability, and everyday usability across cPanel & WHM. Highlights include:

• Modernized HTML Editor (Jodit, Beta): A cleaner, more reliable HTML editing experience inside File Manager.  

• Webmail improvements: Enhanced reliability and smoother handling across core webmail functions. 

• Sieve support (Dovecot 2.4): More advanced and dependable mail filtering capabilities. 

• Stability fixes: Improved SSL verification, backup file creation, and file lock handling to enhance system reliability. 

These updates make everyday hosting tasks more intuitive and dependable for users and administrators alike.

What’s Coming in 2026

Development is underway for a range of enhancements planned for 2026, focused on improving efficiency, security, accessibility, and operational scale across cPanel & WHM:

• Built-in AI Support Agent: A semantic search–based assistant available in cPanel & WHM to help admins resolve issues faster and reduce repetitive support tickets.
• MCP server support in WHM: Admin-level MCP support enabling UI management through prompts, expanding how administrators interact with and manage the platform.
• Native Comet Backup integration: Native backup support designed to simplify and strengthen backup workflows.
• Renewed SSL experience: Improved workflows for managing and converting paid SSL certificates.
• SEO powered by XOVI: SEO capabilities integrated into cPanel through XOVI, providing insights and tools directly within the platform.

These upgrades will further modernize security, backup processes, and your overall cPanel experience. 

A Year of Progress 

2025 marked a year of meaningful progress for cPanel. From security and lifecycle support to AI-powered tools, monitoring improvements, and platform enhancements, cPanel continues to evolve to support hosting providers, server admins, and end users with a safer, smarter, and more future-ready platform.

As we close out the year, we thank our community for your continued trust and feedback. Your input helps shape every improvement we deliver. We wish you a successful and innovative year ahead.
Happy New Year from the cPanel team.

The post cPanel 2025: A Year in Review and a Look Ahead appeared first on cPanel.

From expanded temporary domain support to a new HTML editor, this release focuses on faster setup, better email management, and improved system performance. 

Top Release Highlights  

Temporary domain expansion 

Building on the temporary domain functionality introduced in v130, v132 brings this feature directly into the cPanel Domains interface. 

Users can now quickly create and manage accounts with temporary domains, perfect for testing new products, staging sites, or onboarding new customers, without waiting for full domain registration. 

Additional improvements include: 

• Support for parking registered domains on temporary domains. 
• Improved temporary-to-registered domain conversion with enhanced validation. 
• Ability to create temporary domains even when ‘Allow Remote Domains’ is disabled. 
• DNS edit prevention for temporary domains. 

Note: The primary account domain cannot be converted from temporary to registered. Please contact your hosting provider in order to update your main domain. 

Introducing new HTML editor: Jodit (Beta)

cPanel v132 introduces the Jodit Editor, a brand-new HTML editor (Beta) inside File Manager. Replacing the legacy editor, Jodit offers a more intuitive and powerful experience with: 

• Real-time WYSIWYG editing. 
• Enhanced formatting and styling options. 
• Improved performance and responsiveness. 

With Jodit Editor, users can easily create and modify HTML files right within cPanel, meaning no external editor is needed. 

Dovecot 2.4 with Pigeonhole Sieve Support  

This release introduces a major upgrade to Dovecot 2.4, including full Pigeonhole Sieve support for both Dovecot and Roundcube. 

Users can now easily create server-side email filtering rules right inside Roundcube, making inbox management more efficient and reliable. 

Important Note for Administrators: 

• Dovecot 2.4 introduces changes to configuration parameters; if you use a .local configuration file, update your templates accordingly. 
• Passwords using MD5 will continue to function as expected after updating to v132. The system will automatically use an updated hash when the password is reset.

Expanded OS Support: AlmaLinux 10 and Ubuntu 24 

cPanel continues its commitment to modern, enterprise-ready platforms with new compatibility for AlmaLinux 10 and Ubuntu 24 LTS. 

This includes: 

• EasyApache 4 and cpanel-plugins support on AlmaLinux 10. 
• Added support for Ubuntu 24, giving more options to hosting providers and system administrators. 

Additionally, RHEL 9-based systems (including AlmaLinux 9, Rocky Linux 9, and CloudLinux 9) must now be on version 9.5 or later to install or upgrade to v132. 

Security, Performance, and System Enhancements 

Security improvements 

cPanel & WHM v132 delivers multiple hardening and compliance updates: 

• Stronger file permissions on /etc/trueuserowners to prevent unauthorized read access 
• Blocked unauthenticated users from enabling debug mode via URL parameters 
• Added robots meta tag to login pages 
• Improved SSL certificate verification and error handling 
• Enhanced SpamAssassin report encoding to meet RFC 2047 standards 
• Updated notification settings to alert the root user of password changes and API token creation  

DNS and transfer enhancements 

• Ability to customize default DMARC records via WHM API 1 (set_default_dmarc_record) 
• Support for TXT records over 255 characters 
• Correct ownership assignment for system domains in DNS Zone Manager 
• Improved filtering and transfer support for automatically assigned domains 

WHM administrators can now also define custom search keywords for plugins, improving discoverability and navigation. 

Third-party and component updates 

cPanel v132 includes several key component upgrades for enhanced performance and security: 

• Dovecot 2.4.1 and Roundcube with Sieve integration 
• Perl 5.42 with updated CPAN modules 
• Git 2.48.2, PHP 8.4.12, AWStats 8.0, Mailman 2.2.0-35 
• cpanel-clamav 1.0.9 (CVE-2025-20260) 
• cpanel-sqlite 3.50.3 (CVE-2025-6965) 
• PowerDNS now supports nsec3_iterations value of 0 

Bug fixes and performance improvements 

This release also delivers extensive fixes and refinements, including: 

• Improved domain restoration and conversion handling 
• Enhanced dependency resolution for optional plugins 
• Better terminal memory limit enforcement per user 
• Accessibility improvements across interfaces 
• Resolved performance issues in the Email Accounts interface 
• Fixed SSL initialization and authentication policy inconsistencies 

WebPros SSO Integration 

This version introduces WebPros Single Sign-On (SSO) allowing users to authenticate seamlessly across WebPros products. 

In addition, WHM administrators can now log in using their WebPros Account credentials via the Manage External Authentications interface. 

This feature is currently in limited release and will expand to more users in future updates. 

Platform Support and Requirements

• Added Support: AlmaLinux 10, Ubuntu 24 
• Minimum RHEL 9 Requirement: 9.5 or newer 
• Removed Support: MySQL 5.5 and 5.6 on AlmaLinux 8 

These updates ensure that cPanel & WHM remains compatible with the latest secure and stable Linux distributions. 

Before You Upgrade 

Please note the following upgrade requirements for v132: 

• Servers running MySQL 5.5 or 5.6 must upgrade to a supported MySQL or MariaDB version before installing v132. 
• AlmaLinux 9, Rocky Linux 9, and CloudLinux 9 systems must be on version 9.5 or newer. 
• Review your Dovecot configuration and password policies before upgrading to ensure compatibility with 2.4 changes.  

Update Now 

From updated OS compatibility to smarter mail handling and security hardening, v132 is built for a smoother, more powerful hosting environment. Upgrade today to keep your systems up-to-date and secure. 

For detailed technical notes and further information on the release, visit the cPanel & WHM v132 release notes.  

The post Introducing cPanel & WHM Version 132  appeared first on cPanel.