Getting an AI-built app from a working preview onto your own domain can still mean an unfamiliar hosting setup. AI App Hosting gives Node.js projects a guided deployment path in cPanel’s Meridian interface, using a ZIP file or Git repository, with an additional route through a compatible AI agent connected over MCP.

TL;DR

• AI tools are changing how people create apps. Hosting needs to make the next step, running and maintaining them, more approachable.
• AI App Hosting brings source deployment, container-based execution, app controls, logs, and MySQL connections into cPanel.
• Start during a new account’s initial onboarding in Meridian, or later from Websites & Apps. You need cPanel & WHM 138 or later and AI App Hosting enabled by your provider; newer capabilities require the corresponding plugin updates.

Why does AI-assisted development change what hosting needs to offer?

AI-assisted development changes the starting point for a hosting customer. Someone can arrive with an app they have already built and tested in another tool, looking for somewhere to run it. That makes the handoff from creation to hosting a product experience worth designing.

The 2026 Stack Overflow Developer Survey reports that 73% of respondents who use AI coding assistants or agents use them daily. The report also describes a gap between using AI to generate code and using it to deploy, operate, or troubleshoot production systems. Creating the code is becoming routine; the work after generation still needs attention.

For me, the implication is straightforward: hosting needs to meet customers where their projects begin. A developer may prefer a Git repository, while someone building their first app may have an exported archive. Both need a clear route to a live URL and a way to make the next change. The creation tool should not determine whether that customer can use their existing hosting account.

Why is Node.js relevant to this shift?

PHP has long been central to web hosting, and it still leads. But the mix is changing: W3Techs records PHP’s share falling from 76.7% in January 2024 to 69.3% in October 2026 among websites whose server-side language it can identify. For me, that reinforces the case for broadening what hosting offers: continuing to serve PHP websites well while making room for applications built on other runtimes.

Node.js is relevant because prominent AI builders produce JavaScript applications with server-side capabilities. v0 defaults to Next.js. Lovable documents a shift from React/Vite apps that build to static files to TanStack Start for new apps created from May 13, 2026, adding server-side code. TanStack Start provides a Node.js deployment path.

That changes what a hosting service must do. Static files can be served directly; server-side applications also need their code to run when visitors use them. Node.js may be part of the build process for either, so a JavaScript project does not automatically require a persistent Node.js server. The practical question is what the exported application needs to build and run.

Node.js also has an established developer community: it ranks first in the 2026 Stack Overflow Developer Survey’s web-technologies category. For hosting providers, that makes it a practical place to invest. The same deployment experience can serve developers already building with Node.js and customers discovering these frameworks through AI tools.

What opportunity does this create for hosting providers?

The opportunity is to support more of the app’s life after creation. For a freelancer or small business, a working preview is followed by practical questions: Where will it run? How will it reach a database? What happens when an update fails?

Customers may already trust their provider with domains, email, and websites. I see an opportunity to extend that relationship to the apps they build with AI, with deployment and ongoing management in the same place. The value is in making familiar hosting useful for a new kind of project.

There is also a choice about how customers interact with hosting. Some want to review settings in a panel; others want an external AI agent to carry a task forward from the development environment. My product view is that both should reach the same hosting capabilities. That makes the API part of the customer experience alongside the interface.

Our cPanel feature-priority survey reinforced the need: improved Node.js development tools received 488 votes from 3,300 respondents, or 14.8%. This feedback, alongside the changes in app creation, shaped what we built.

What did we build, and what does it change?

AI App Hosting deploys existing Node.js projects and provides controls for running them, whether their code was written by hand or generated with AI.

cPanel already offered Node.js support through Application Manager and Passenger. AI App Hosting brings source deployment and app management together in Meridian, backed by the same application-hosting API used by external AI agents.

Apps use rootless containers managed by Podman, with resource limits. The guided deployment handles the container and reverse-proxy setup, so customers can focus on their application.

How do I deploy from a ZIP file or Git repository?

Choose AI App Hosting during initial Meridian onboarding or later from Websites & Apps. You can also deploy through an external AI agent connected to WebPros MCP, using the same underlying hosting capabilities. The browser workflow is outlined below; the section on external AI agents explains how to connect. The deployment guide covers the full sequence:

1. Choose a domain. Follow the onboarding prompts, or use Add Website on an existing account.
2. Provide the source. Upload a ZIP or enter a Git clone URL. Private repositories use guided SSH-key setup.
3. Review and deploy. Check detected settings and add environment variables or a database when needed.

Deploying to an existing domain changes what visitors see there; its existing files remain.

Apps may also depend on external authentication, storage, or databases. Deploying the source does not move those services into cPanel.

What happens after the first deployment?

The app’s Manage view provides configuration, environment variables, and logs, plus start, stop, and restart controls for server apps.

Use Redeploy to pull updated Git code, rebuild, or apply configuration changes. App Logs provides output you can refresh or download. The management guide explains the controls.

Starting from AI App Hosting 1.3.5-1, with Meridian 1.4.0-1 or later, you can create or link a MySQL database and supply connection details through environment variables. The app must use those values; this does not migrate an external database.

Can an external AI agent deploy the app for me?

An external AI agent, such as Claude Code, can deploy through WebPros MCP. This is separate from Meridian’s embedded AI Assistant. MCP connects the agent to cPanel’s tools.

Choose Deploy via WebPros MCP and follow the connection guide to link your WebPros account and authenticate the agent.

The agent needs access to your project and the tools and account permissions required to transfer files and deploy.

How do providers make AI App Hosting available?

Providers enable Web Apps through WHM Feature Manager and the feature lists used by their hosting packages. The server also needs the required components and configuration.

AI App Hosting is included in cPanel. Providers decide which hosting plans offer access and what those plans cost.

What are we working on next?

Our roadmap includes improvements to deployment, day-to-day management, and app reliability. Alongside package-manager controls and curated apps to make getting started easier, here are two highlights from our near-term and longer-term plans:

• Self-healing for recoverable failures. We’re adding automatic health checks and diagnosis to detect when an app stalls or stops, then restart it when recovery is appropriate. Retry limits will prevent repeated restart loops, and notifications will let you know when action is needed. Health status and incident history in Meridian will help you understand what happened.
• Python support in AI App Hosting. Looking further ahead, we’re planning to bring Python applications into the guided hosting experience in 2027.

We’ll share these improvements in the release notes as they become available.

How can I try AI App Hosting?

Choose AI App Hosting during Meridian onboarding or from Websites & Apps on an enabled cPanel & WHM 138 or later account. Check the release notes for newer capabilities.

Deploy the project, open its URL, and try an update. That complete cycle is what we want to make easier. Share what worked and where you got stuck through the AI App Hosting feedback page; it helps us decide which parts of the experience need attention next.

The post The Rise of AI-built Apps: Why Hosting Needs to Evolve appeared first on cPanel.

Because PHP underpins a large share of the web, including many hosting environments, cPanel immediately assessed the impact across its products and has since been releasing updates and guidance for customers and partners.

This post outlines the vulnerabilities, summarizes cPanel’s response, and explains what administrators should do next.

What Was Addressed 

On 21 October 2026 at 13:30 UTC, the PHP project published fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities are rated CVSS v4.0 9.2.

CVE-2026-109618 allows remote code execution through memory corruption during out-of-memory handling. PHP enforces its memory_limit setting by aborting a request that exceeds the limit. This can interrupt PHP while internal request data, such as a multipart file upload, is only partially initialized. Request cleanup may then try to free memory that was never initialized, and that memory may still hold attacker-influenced data from earlier allocations.

CVE-2026-109619 allows remote code execution through stale global state. Internal state owned by a request can survive after its backing memory is freed, for example after a fatal error. A later request handled by the same worker may use that stale state before normal initialization resets it.

Every PHP installation that serves web requests is potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers mod_php the highest-risk configuration. End-of-life branches (PHP 8.1 and older) are also affected and no longer receive updates from the PHP project. The PHP security team has published minimal source backports for PHP 7.4, 8.0 and 8.1.

Public proof-of-concept code has begun to circulate, increasing the likelihood of exploitation attempts.

This is a vulnerability in PHP itself, not in cPanel & WHM or WP Squared. Products that bundle or depend on PHP are affected to the extent they use an unpatched PHP runtime.

How We Responded 

cPanel took part in the PHP project’s coordinated disclosure, so fixed packages were built and tested before the public release. Once fixes were public, we rolled out updated PHP packages, product releases and mitigations. EasyApache 4 PHP updates were on our mirrors within minutes of PHP’s public release, and fixed builds for every supported cPanel & WHM version followed within an hour.

The status below reflects what had been published as of 23 October 2026.

cPanel & WHM and WP Squared 

Updated PHP packages and an automated fixer were released for cPanel & WHM. WP Squared 11.138.1.18 was released with security fixes and an updated WP Toolkit. Administrators should apply updates through their normal update process.

1. EasyApache 4 v25.91 (October 21): ea-php82, ea-php83, ea-php84 and ea-php85 updated to 8.2.35, 8.3.36, 8.4.27 and 8.5.12. ea-php74, ea-php80 and ea-php81 received the PHP project’s backported fix, so customers on PHP 7.4, 8.0 and 8.1 under EasyApache 4 are covered too. EasyApache 4 packages for PHP 7.3 and older did not receive this fix.

2. EasyApache 4 v25.92 (also October 21) followed with updated ea-php74-meta, ea-php80-meta and ea-php81-meta packages, so the CVE backport is listed in their change logs too. No further PHP code change was needed.

3. cPanel & WHM 11.138.0.18, 11.136.0.50, 11.134.0.66 and 11.110.0.153 update the PHP that cPanel & WHM itself runs on (cpanel-php84 8.4.27, and cpanel-php81 8.1.34-2 on 110). All four are flagged as security releases.

4. An automated fixer prompts servers to install these updates, and updates cPanel’s own PHP on older versions 112 through 132.

5. WP Squared 11.138.1.18 is live on all WP Squared tiers.

Change logs: EasyApache 4 and cPanel & WHM 138 (same pattern for 136, 134 and 110). Full details: Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619 

TuxCare 

TuxCare released fixes for distribution PHP on several extended-support operating systems, with further releases in progress.

Recommended Actions 

1. Update PHP. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the fixed package from your operating system vendor, control panel or LTS provider. Restart PHP-FPM, Apache and any other PHP worker processes after updating.

2. Update cPanel products. Apply the latest updates for cPanel & WHM and WP Squared listed above.

3. Replace unsupported PHP versions. If you run PHP 8.1 or older, use a vendor that provides backported fixes, build from the PHP project’s source backports, or upgrade to a supported branch.

4. Check third-party repositories. Community repositories may not have fixed packages on release day. Confirm with your repository maintainer or switch to distribution packages or a supported build.

5. Check architecture coverage. Some package repositories published fixed builds for amd64 before arm64. Verify that every host, including arm64, is actually running a fixed version.

6. Review containers and tooling. Rebuild container images, CI runners and internal tooling that embed PHP, not only production web servers.

cPanel & WHM customers who need to stay on end-of-life PHP versions can purchase Extended Lifecycle Support for PHP.

Temporary Mitigations 

Updating PHP resolves both vulnerabilities. The measures below, from the PHP project’s guidance, reduce exposure to specific attack paths but do not replace the update.

For CVE-2026-109618:  

1. Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration.
   
2. Set a low post_max_size (for example 8M, or 32M where uploads are required) and keep upload_max_filesize below it.
   
3. Enforce request size, field count and multipart limits at the web server or proxy.
   
4. Use container or cgroup memory limits as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable allocation failure.

For CVE-2026-109619:  

1. Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker. Do not rely on ini_set() or .user.ini.
   
2. On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
   
3. Remove invalid or deprecated per-request settings that emit diagnostics before initialization.
   
4. Fix fatal errors and timeouts that attackers can reach.  

Where patching is not immediately possible, consider isolating internet-facing applications from public networks until a fix is applied and verified.

On 23 October 2026 the PHP project recommended keeping session.upload_progress.enabled=0 until its next regular bugfix release, even on patched versions, to fully protect against a related vector (CVE-2026-115560). It only affects applications that change session.serialize_handler at runtime. If you applied this setting for CVE-2026-109619, keep it in place. cPanel & WHM administrators can set it in WHM’s MultiPHP INI Editor.

Working Closely with Partners 

We are working with hosting partners and operating system vendors on legacy and non-standard configurations, including end-of-life PHP versions and multiple architectures. Partner feedback on coverage gaps is shaping follow-up releases. If you are a partner with a specific configuration question, contact your cPanel account representative or support.

Next Steps 

We will continue to update our cPanel support article as additional releases and packages become available. Please refer to Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619 for the most current version and coverage information.

The post PHP CVE-2026-109618 and CVE-2026-109619, Response, Actions and Next Steps appeared first on cPanel.

This release delivers cPanel AI, the first set of AI capabilities built directly into the hosting platform, alongside Meridian, a new goal-based interface designed to make those workflows part of everyday hosting work.

AI has changed how websites and applications get built. Developers build faster with AI coding assistants, small businesses turn to AI-assisted website creation, and agencies produce client work in less time. Every one of those projects still needs domains, DNS, runtimes, databases, email, security, and ongoing management. Hosting is where AI-assisted work becomes a running site or application.

Version 138 puts those workflows on the server. Users can create a site from a description, deploy an AI-built application to production, ask account questions and get answers from inside the panel, and connect approved AI clients under permissions they control. Hosting providers can decide which of these capabilities are available and when.

Top Release Highlights

Meridian – A New Goal-Based Interface

Meridian organizes cPanel around what users are trying to accomplish. Six task hubs cover websites, email, files, databases, security, and performance, each with a dedicated workspace. The Dashboard surfaces account health indicators for SSL status, backup recency, and cPanel version, an Action Required section for items such as expiring certificates or unresolved domains, and suggested next steps based on current configuration. A command palette (Cmd/Ctrl + K) gives experienced users keyboard access to common actions, and light and dark modes sync across devices.

Grouping related tools into task hubs reduces navigation steps, makes features easier to find, and improves adoption of capabilities customers already pay for.

New accounts start with Guided Setup, which covers domain configuration, website creation, and email in one flow. It skips steps that are already complete (DNS prompts for a domain that points to the server, for example), verifies that the site is reachable before launch, and offers a dedicated path for users migrating an existing site. The flow is built to take a new account from first login to a published website in under ten minutes.

Meridian ships as an opt-in theme alongside Jupiter. Both interfaces share the same account data, APIs, and configuration files, so users can switch between them at any time while websites, email accounts, and databases keep running. Administrators can preview Meridian through the WHM Feature Showcase, enable it during account creation, or set it as the default theme for specific hosting packages.

Preview Meridian in WHM and decide which packages should use it by default.

AI Assistant

Users ask questions about their account in plain language and receive answers grounded in cPanel documentation and product knowledge. The assistant explains administrative tasks, provides step-by-step guidance, and diagnoses common account issues from available account data, such as identifying why email delivery has failed or when an account has reached its disk quota.

Resolving routine questions inside the panel reduces documentation searches and Level 1 support tickets. The AI Assistant requires Meridian and separate enablement by the server administrator through panel.ini.

AI App Hosting

AI coding tools produce working applications in minutes, while moving those applications into production still requires runtime configuration, deployment knowledge, and command-line work. AI App Hosting closes that gap.

Deploy Node.js applications from a ZIP archive or a Git URL. cPanel detects common frameworks, configures the runtime, applies deployment defaults, and manages reverse-proxy routing to a live URL. Applications built with AI development tools such as Claude, Lovable, Bolt, v0, and Replit run on the server without SSH access or manual setup, which opens modern application hosting to a wider set of customers. Providers can support these workloads alongside traditional websites on their existing infrastructure. Availability is controlled by the Node.js AI Toolkit flag in WHM Feature Lists, with expanded framework detection planned for a future release.

MCP Support

AI agents are moving past generating code and answering questions, and are increasingly taking actions on behalf of users. That raises a direct question for anyone running infrastructure: what should an agent be allowed to do on a live server?

Model Context Protocol (MCP) support connects approved AI clients, including Claude Code and Claude Desktop, to cPanel through scoped permissions. User-level MCP bounds agent actions to the user’s home directory and requires a connected WebPros Account. Admin-level MCP is available separately for server administrators through WebPros Dashboard.

Permission boundaries, least-privilege access, and audit trails give administrators visibility into what agents can reach and which actions they perform, so AI access to infrastructure stays governed by the same controls as any other integration.

Nova

Describe the website or application you want, and Nova generates a working project, provisions it within the hosting account, and publishes it to the cPanel server. Generation and deployment happen in one place, so the project runs on the server it was built on. Nova is available wherever new projects begin, including onboarding, website creation, and application deployment.

Nova for WordPress

Nova for WordPress builds on the standard WordPress editor, so generated pages use the same Gutenberg blocks administrators work with every day and editing continues in the familiar workflow. It creates pages, content, and configuration from a single prompt, replacing hours of theme and page setup with a round of refinement.

Sitejet AI

Sitejet AI produces a complete first-draft website from a short description of a business, then opens it directly in Sitejet Builder for refinement and publishing. Customers start from a working draft and finish in the same tool they will use to maintain the site. Sitejet AI is available in both Meridian and Jupiter.

More Updates for Server and Account Management

Domain Recommendations and Purchase (Experimental)

cPanel can now recommend available domains to users and route purchases through your WHMCS installation. This keeps domain sales within your billing system and creates an additional revenue path at the moment customers are already setting up a site. Review the experimental status before enabling this in production.

Domain Renaming

Rename primary, addon, and parked domains directly from the Domains interface. Renaming in place removes a common support escalation and the manual work required to correct or rebrand a domain.

WebPros Dashboard Plugin

Connect servers to WebPros Dashboard for multi-server status, alerts, and tools in one view. Teams running more than a handful of servers get consistent visibility without logging into each machine. Link your fleet and set up alerting for the conditions that matter most to your operations.

Exim Spam Action Configuration

Administrators can configure how Exim handles forwarded mail flagged by Apache SpamAssassin. Controlling this behavior at the server level helps protect forwarding reputation and reduces the risk of downstream providers rejecting mail. Review your current forwarding policy and set the action that fits your deliverability requirements.

API Additions

New UAPI and WHM API 1 functions cover domain renaming, document roots, and PHP error logs, giving providers direct automation paths for the workflows introduced in this release. Update provisioning and support scripts to use the new endpoints where they replace manual processes.

Short-Term SSL Reissue

Certificates purchased through the cPanel Store can be reissued for short-term use, supporting the industry shift toward shorter certificate lifespans introduced in earlier releases.

Built for the Next Phase of Hosting

cPanel AI was shaped by requirements and feedback from hosting providers, system administrators, agencies, and developers running production cPanel environments. It reflects a shift underway from code-first workflows toward AI-assisted development and increasingly autonomous infrastructure operations.

Version 138 is the first release of cPanel AI, and the capability set will keep expanding across deployment, infrastructure management, and support.

Learn More

For full technical details, review the complete v138 release notes.

The post Introducing cPanel AI in cPanel & WHM v138  appeared first on cPanel.

Feedback from the cPanel community has made one thing clear: users want the power and control they’ve always relied on, combined with a more modern, intuitive experience that helps them complete common tasks faster. 

Meridian is cPanel, organized around what you are trying to accomplish. It introduces a redesigned, goal-oriented interface for cPanel with guided onboarding and task-based workflows that make it easier to move from account setup to a working website and ongoing management. Instead of navigating a long list of individual tools, users can work through experiences organized around real objectives – such as managing websites, configuring email, improving security, and monitoring performance.  

Built on the cPanel Foundation You Trust 

Meridian builds on the existing cPanel foundation rather than replacing it. It ships alongside the Jupiter interface as an optional theme starting in cPanel v138, with both experiences sharing the exact same account data, APIs, and configuration files. 

• Zero-Downtime Theme Switching: Users and administrators can move between Meridian and Jupiter at any time without affecting live websites, email accounts, databases, or existing settings. 

• Preserved System Tools: Core platform functionality remains intact. Power-user utilities like Terminal, Cron Jobs, and Raw Access Logs remain accessible directly or via Jupiter. 

• Full Administrator Control in WHM: Hosting providers can preview Meridian via the WHM Feature Showcase, set it as the default interface for specific hosting packages, or manage feature permissions via WHM Feature Lists. 

AI built in with the Meridian Experience 

As AI becomes an integral part of application development, hosting needs to evolve beyond supplying raw infrastructure. Meridian brings AI-assisted workflows directly into the cPanel interface. 

• AI App Hosting (Node.js Engine): Enables deployment of Node.js applications created with AI coding tools like Claude, Lovable, Bolt, v0, or Replit. Controlled via the Node.js AI Toolkit flag in WHM Feature Lists, Meridian ingests ZIP archives or Git repositories, detects common frameworks, configures runtimes, and manages reverse-proxy routing – with expanded framework detection planned for a future release. 

• User-Level Model Context Protocol (MCP): Delivers permission-scoped access for AI agents through a connected WebPros Account, ensuring automated actions remain safely bounded to individual user directories (/home/username). Requires both Meridian and a WebPros Account. A separate Admin-level MCP tier is also available independently of Meridian for server administrators via the WebPros Dashboard. 

• Sitejet AI: Generates editable website drafts from a brief text prompt, allowing users to continue refining their site inside the Sitejet builder across both Meridian and Jupiter. 

• Integrated AI Assistant: Exclusive to Meridian, this built-in assistant provides contextual UI guidance and answers support questions directly inside cPanel, helping users complete routine tasks while mitigating Level 1 support tickets. Requires separate enablement by the server administrator via panel.ini configuration flags. 

• Nova & Nova for WordPress: An AI-powered site builder embedded directly in Meridian’s onboarding and website creation flows. Users describe their site in a brief text prompt, and Nova generates a complete, editable website draft – either as a standalone site or as a fully configured WordPress installation. Currently only available to cPanel Partners.  

All these features are exclusively available to cPanel Partners as part of Early Access immediately. 

More about Meridian 

Guided Onboarding Flow 

New accounts begin with an adaptive, self-evaluating setup pipeline designed to take a new account from first login to a published website in under ten minutes. 

• Conditional Logic: Evaluates domain records, site builders, and hosting plan capabilities automatically. For instance, if a domain already points to the server, DNS configuration prompts are automatically skipped.
• Three Flexible Entry Modes:
  • Guided Setup: Walks step-by-step through domain configuration, email, and site creation.
  • Move an Existing Website: Focuses specifically on migrating an existing site.
  • Expert Mode: Skips onboarding entirely and opens the main dashboard immediately.
• Pre-Flight DNS Verification: Verifies site reachability prior to launch. If DNS propagation is still pending, it displays the required nameservers so users know exactly what remains to be done.

Workspace Restructuring: Six Workspaces Built around Real Tasks 

Instead of presenting more than a hundred individual tools, Meridian groups related functionality into six dedicated, objective-based workspaces to eliminate context switching: 

A Dashboard that Prioritizes what Matters 

After onboarding, users arrive at a personalized dashboard that provides immediate visibility and faster day-to-day administration: 

• Account Health Indicators: Surface real-time status checks for SSL health, backup recency, and the running cPanel version. 

• Actionable Insights: An Action Required section highlights urgent issues (such as expiring SSL certificates or unresolved domains), while Suggested Next Actions recommends logical next steps based on current configurations. 

• Command Palette: Experienced administrators can press Cmd+K (Mac) or Ctrl+K (Windows) to search and trigger common actions, such as “Create Email Account” or “Manage SSL”, directly from the keyboard without navigating visual menus. 

• Custom Appearance: Includes light and dark modes with preferences synchronized across devices. 

Availability & Deployment 

Meridian will be available as an opt-in theme in cPanel v138, starting September. Watch your inbox for specific roll out information. System administrators can preview the interface via the WHM Feature Showcase or provision it as the default interface for hosting packages. 

Explore the broader cPanel AI platform to see how AI-powered website creation, deployment, and management come together in a single experience. 

Frequently Asked Questions 

What is cPanel Meridian? 
Meridian is a goal-oriented interface theme for cPanel that organizes account management into six task-focused workspaces, adds guided onboarding, and integrates native AI deployment tools. 

Does switching between Meridian and Jupiter risk data loss? 
No. Switching interfaces changes only how cPanel is visually presented. Domains, email accounts, databases, files, and server configurations remain identical and unaffected. 

How do system administrators enable Meridian? 
Meridian is available as an opt-in theme in cPanel v138+. Administrators can preview it through the WHM Feature Showcase, enable it during account creation, or set it as the default theme for hosting packages in WHM. 

Which AI features require the Meridian theme? 
The AI Assistant is exclusive to Meridian and requires separate enablement via panel.ini. AI App Hosting and User-level MCP ship with Meridian and require activation by an admin (Node.js AI Toolkit flag and WebPros Account respectively). Nova is embedded in Meridian but also available standalone. Sitejet AI is available independently across both Meridian and Jupiter. 

How quickly can a site be launched with Meridian? 
The guided onboarding workflow is engineered to take a new account from initial login to a published, reachable website in under ten minutes. 

The post Meridian: A New cPanel User Experience appeared first on cPanel.

Developers are shipping applications faster with AI coding assistants. Small businesses expect AI-assisted website creation. Agencies want to launch client projects in minutes instead of hours. Every one of these expectations eventually lands on a hosting provider’s support desk and infrastructure, whether or not the provider had a hand in building the site.

Hosting platforms need to evolve to meet that demand at the infrastructure level.

cPanel AI introduces a new generation of capabilities built directly into cPanel & WHM that hosting providers can offer as part of their own service: AI-assisted website provisioning, contextual support, application deployment, and secure AI-to-infrastructure connectivity. cPanel AI extends the hosting workflows providers already run, giving their customers faster ways to get online while keeping the provider in full administrative control of the environment.

Why the Web Hosting Landscape is Shifting

AI is no longer just generating copy or drafting emails; it has become an integral engine across the entire digital lifecycle, from initial development through long-term server operations.

Key trends driving this industry evolution include:

These trends are also measurable across the cPanel ecosystem.

Since January 2026, Node.js domains running on cPanel servers have increased by 35%, reflecting growing adoption of modern application runtimes alongside traditional PHP-based websites.

As AI lowers the barrier to building software, hosting providers need infrastructure that supports a broader range of application types while maintaining the reliability, security, and operational efficiency their business depends on.

Bringing Modern AI Workflows Directly to cPanel

Hosting providers reported a need for simpler provisioning, faster deployment pipelines, and more efficient support workflows, along with granular control over how AI interacts with their infrastructure. Those requirements shaped the architecture of cPanel AI.

Over the past several months, cPanel gathered input from hosting providers, system administrators, agencies, and developers operating production cPanel environments. That input reinforced findings from the 2025 cPanel Survey: the underlying technology is changing quickly, but the core operational challenges (provisioning speed, deployment complexity, and support load) remain consistent.

cPanel AI is a set of capabilities built directly into the cPanel & WHM stack that automate provisioning, accelerate deployment, and streamline infrastructure management, while keeping the provider in control of how AI operates within their environment. Here is a technical overview of what’s coming.

Meridian

Meridian is a redesigned cPanel interface architecture organized around the administrative tasks providers and their teams perform most often.

Users work from dedicated workspaces for Websites, Email, Files, Databases, Security, and Performance. Each workspace brings related capabilities together, making common hosting tasks more discoverable and workflows more efficient.

New accounts start with a guided onboarding sequence that takes an account from creation to a live website in under ten minutes, cutting down the setup questions that would otherwise land in a provider’s support queue. Returning users land on a personalized dashboard with quick access to frequently used tools, a global command palette for keyboard-driven navigation, and support for both light and dark display modes.

Meridian runs in parallel with the existing cPanel interface as an opt-in environment, so providers can migrate their operation on their own timeline without a forced cutover.

Visit the Meridian Documentation to learn more.

AI Assistant

The Integrated AI Assistant is a contextual, natural-language support layer embedded in cPanel, so account holders can resolve common questions directly instead of opening a support ticket.

Responses are grounded in cPanel’s documentation corpus and product knowledge base. The assistant explains administrative tasks, provides step-by-step remediation guidance, and analyzes available account telemetry to help diagnose operational issues, including email delivery failures, DNS misconfigurations, and other configuration errors, before they turn into a ticket in the provider’s queue.

As the platform matures, the assistant will also execute routine administrative actions following explicit user confirmation, reducing time-to-resolution on common tasks while keeping the account holder in control of what actually changes.

Visit the AI Assistant Documentation to learn more.

AI App Hosting

AI App Hosting deploys applications built outside cPanel, including those built on platforms such as Claude, Lovable, Bolt, v0, and Replit, into a production-grade hosting environment a provider already runs.

The deployment pipeline works as follows:

1. Upload a ZIP archive, connect a Git repository, or trigger deployment directly through the MCP Server.
2. cPanel provisions the runtime and applies deployment defaults.
3. The application deploys to a live URL.

This pipeline runs without manual server configuration or a CLI-based deployment step, which means a provider can support this fast-growing category of AI-generated applications without retraining a support team on every AI coding platform that produced them.

Applications built inside cPanel and applications built in an external AI development environment run on the same underlying hosting infrastructure, with no separate stack to provision or maintain.

MCP Server

As organizations manage larger hosting environments, AI needs a secure way to interact with infrastructure.

The MCP Server is a secure connection layer that lets AI agents interact with one or more cPanel servers through scoped, permissioned access the provider controls. As hosting environments scale, this gives AI systems a governed, auditable integration path into infrastructure instead of broad, unscoped access.

Through a single integration point, a provider can query infrastructure state, retrieve server metadata, monitor service status, and execute approved actions.

Permission boundaries, least-privilege access controls, and audit logging give administrators complete visibility into what each AI agent can access and every action it performs.

Visit the MCP Documentation to learn more.

Nova

Nova is an agentic website and application builder that hosting providers can offer as part of their own service, generating and deploying projects directly from natural-language prompts on the provider’s infrastructure.

A user describes the project in plain language, and Nova generates the codebase, provisions the hosting account, and deploys the result directly to the cPanel server it runs on. The whole pipeline runs inside that hosting environment, so there’s no third-party deployment tool pulling traffic somewhere else.

Nova is exposed at every point where new projects start: onboarding, website creation, and application deployment.

Nova is currently available only to cPanel Partners.

Nova for WordPress

Nova for WordPress is an AI-assisted site generator built for WordPress, the most widely deployed CMS in the cPanel ecosystem.

A user describes the website they want, and Nova for WordPress generates a complete WordPress instance and deploys it directly to the cPanel server. The instance is built on the standard WordPress editor, so anyone editing it afterward, including the provider’s support team, is working in familiar territory.

This shortens time-to-launch for a business site, a personal project, or a client build, without changing the WordPress workflow a provider already supports. Nova for WordPress currently available only to cPanel Partners.

Sitejet AI

Sitejet AI is a streamlined website generation workflow for anyone who needs a production-ready draft quickly.

A user describes a business in a sentence or two, and Sitejet AI generates a complete first draft that opens directly in Sitejet Builder for refinement and publishing. From there, the draft can be customized and published inside the same hosting environment it was generated on.

cPanel has evolved alongside the technologies that define the web throughout its product history. Across each release cycle, from supporting new application frameworks to advancing security, automation, and management tooling, cPanel has focused on giving hosting providers the tools to operate efficiently and compete effectively.

cPanel AI represents the next iteration of that evolution. By combining automation, AI-assisted workflows, and intelligent infrastructure management, cPanel is building the capability set providers need to support the next wave of hosted applications and businesses, delivered through the provider’s own platform.

cPanel will continue gathering input from providers, watching how platforms actually get used, and shipping updates that help providers keep pace as the underlying technology shifts.

Visit the Sitejet Builder Documentation to learn more.

Frequently Asked Questions

What are the primary capabilities included in cPanel AI? cPanel AI introduces an updated user interface, an AI support assistant, streamlined AI app deployment pipelines, secure infrastructure connectors, and AI-powered site-building tools directly within the cPanel & WHM environment.

How does cPanel AI handle deployment for modern AI applications? cPanel AI provides a smooth transition layer from AI development tools straight to hosting infrastructure, allowing application builds to be hosted and managed securely without complex manual setup steps.

Does cPanel AI compromise server control or administration? No. cPanel AI operates through a secure AI-to-infrastructure connection layer that respects existing administrative privileges, safety rules, and server configurations.

Stay tuned

Visit our Release Notes for additional technical details and follow for more as cPanel AI moves toward general availability.

Want to be among the first to learn more? Sign up for updates, and we will keep you informed as we announce new capabilities, previews, and availability information.

The post cPanel AI: The Next Evolution of the Control Panel​ appeared first on cPanel.

We’ve gone through every section of the data, from the feature votes and open-text comments to the AI capability questions and satisfaction ratings, and we’re sharing the full picture here.

Some of what you’ll read below is also a preview of a broader shift already underway inside cPanel & WHM: a more modern interface and a rebuilt security layer are already in progress, and an AI assistant built for the way server admins actually work is on the roadmap as a direct result of this feedback. This survey is the foundation that shift is built on.

Want more direct input into what we build next? Sign up for our UX program and help shape features before they ship.

Survey Audience

The 2025 survey drew 3,300 completed responses from across the cPanel & WHM user base, representing a significantly broader cross-section of the community. 

Most respondents are long-tenure users: 92.7% have been using cPanel & WHM for years, with only 2.39% considering it for the first time. This is a survey of people who know the product well, which makes the feedback more meaningful. 

Here are the different segments of the survey respondents by business type: 

Many respondents hold multiple roles simultaneously, with common overlaps between IT Directors and System Admins, and between CTOs and IT Directors. These are the people responsible for running hosting infrastructure day to day, often across multiple servers and customer accounts. 

An additional 842 respondents indicated they are open to speaking directly with our Product Managers about the improvements they want to see in 2026. 

Overall Satisfaction: NPS Score 

The average NPS rating for cPanel & WHM 2025 changes came in at 28, with the following breakdown: 

• Promoters: 45.9% 

• Passives: 36.3% 

• Detractors: 17.8% 

An NPS of 28 in a mature infrastructure product is a meaningful signal. Nearly half of our user base are active promoters. At the same time, the open-text responses make clear that there is real pressure on perceived value, and we’re addressing that directly later in this post. 

Most Valued Features Delivered in 2025 

We asked respondents to identify which updates delivered during 2025 they found most valuable. The results reflect a user base that values platform stability, compatibility, and performance at the core layer. 

Here are the top 5 valued changes by percentage of respondents selecting each: 

EasyApache 4 updates leading with over half of all respondents selecting them is a clear signal: the hosting stack’s PHP, Apache, and extension layer is where operational reliability lives for most providers. That’s where we invested, and it registered. 

WP Toolkit appearing in the top five confirms what the broader hosting data also shows: WordPress management has moved from a nice-to-have into a core operational requirement for providers across all segments. 

Top Requested Features for 2026 and Beyond 

Respondents were asked to identify the features they most want to see built into cPanel & WHM. Here are the 12 most-requested features by response volume: 

A few things stand out here. 

The Native Firewall Manager is the clear priority signal 

At 46.3%, it outranked every other request by a significant margin. The discontinuation of ConfigServer Firewall (CSF) left a real gap in the security stack, and many administrators are still running unmaintained installs while waiting for a native replacement. This is operationally urgent for a meaningful segment of our user base, and it’s why the WebPros Shield project is currently in progress, targeting H2 2026. 

Security and performance advisory ranked second 

Providers want the panel to proactively surface issues before they become incidents. A unified advisor available across cPanel and WHM is in definition phase now, targeting Q4 2026. 

Backup management ranked third 

The absence of a native incremental backup system has been a recurring pain point. Comet Backup integration into cPanel and WHM is actively in progress, targeting Q3 2026. 

Webmail is on the horizon soon 

Roundcube is consistently described as outdated relative to what end users now expect from an email client. Business Email integration is currently in definition, targeting Q3 2026. 

For the full status of these requests and where they sit on the roadmap, visit: features.cpanel.net.

AI in cPanel & WHM: What Users Actually Want 

AI was one of the most active sections of the entire survey, and it’s a clear preview of where cPanel & WHM is headed next. We dedicated a full section to it, specifically asking which AI capabilities users want built into the panel, and received 1,727 responses to that question alone, one of the highest response volumes of any section in the survey.

The results break down into nine clear categories:

A strong pattern emerges across nearly every category: this isn’t a user base asking for AI as a gimmick. It’s a user base asking for AI that acts like an experienced sysadmin looking over their shoulder, catching what a human would eventually catch, but faster and around the clock.

The single most-requested capability, by a wide margin, is an AI assistant that reads server logs, identifies the source of a problem, and explains what to do about it. They want the kind of tool that turns a 2am log dive into a clear next step. Resource diagnostics, security anomaly detection, and automated spam filtering follow the same logic: respondents want AI that’s useful, contextual, and actionable, not a feature for its own sake.

What ties all of these together is specificity. Respondents are describing an AI layer that is contextual to their server, actionable in the moment, and integrated directly into the workflows they already use, not a separate destination they have to remember to check.

We take the caution in the data just as seriously as the enthusiasm. 57 respondents (3.3%) explicitly oppose AI integration, primarily citing concerns about data privacy, additional cost, and forced feature adoption. That feedback is shaping the implementation as much as the demand is: everything we build here will be opt-in, transparent about what data it touches, and designed so that providers who want nothing to do with it can simply ignore it entirely.

One quote from the open-text responses captures the prevailing mood well:

“Give us a real AI assistant that reads logs, spots problems, and tells me what to do. That I’d pay for.”

That’s exactly the brief we’re building to. An AI Support Assistant in the GUI, grounded in real log data and real server context rather than generic suggestions, is currently in scope for Q3 2026, and it’s one of the pieces of the broader platform transformation we’re most energized about.

What the Open-Text Responses Tell Us 

Beyond the structured questions, we received over 4,100 open-text responses across three separate questions: 

• “If you could change one thing about cPanel & WHM” 

• “Which modern AI features would you like to see integrated?” 

• “What can we do to improve the rating you set?” 

We analyzed all of them. Here’s what the data says. 

The UI is getting attention 

The second-largest category in the “one thing to change” responses is UI and UX modernization, at 15.5% of answers. Dark mode is the single most-requested cosmetic change, and feedback on the WHM sidebar navigation, mobile responsiveness, and task efficiency appears consistently across responses. 

That work is already underway. We’re introducing Meridian, a fully revamped end-user interface that replaces Jupiter’s grid of 100+ tools with goal-oriented navigation organized around six areas: 

• Websites 

• Email 

• Files 

• Databases 

• Security 

• Performance 

Meridian ships as an opt-in theme alongside Jupiter and updates on its own cadence, so providers can manage rollout on their schedule. 

A native firewall is coming 

Security and firewall concerns account for 7.5% of the “one thing to change” responses and 6.6% of the improvement suggestions. Administrators want a native, maintained solution built into the panel itself, and that is exactly what we’re delivering. The Native Firewall Manager is our top-ranked feature request and our top development priority. We’re committed to closing this gap. 

Back to core 

A segment of respondents expressed that they want cPanel & WHM to stay focused on what it does best: reliable, precise server management. That feedback is noted. Our goal for 2026 is to ship meaningful improvements to the core platform, including security, backups, email, performance visibility, and let that work speak for itself. 

What is working 

145 respondents indicated no desired changes or expressed direct satisfaction with the product. That’s 7.7% of the “one thing to change” responses, and it’s an important signal. The core platform, the WHM management layer, the integration ecosystem, and the overall reliability of cPanel-powered environments are consistently praised. The areas of frustration are specific and addressable, and that’s exactly the kind of feedback we can act on. 

What We’re Building in 2026 

The survey results confirmed our priorities. The three areas with the strongest demand signal are all actively in development. A native firewall manager and brute-force protection layer is currently being built to replace the gap left by CSF. 

Improved backup management, including incremental backup support via Comet Backup integration, is in progress. And a unified Security and Performance Advisor, surfacing proactive recommendations directly inside the panel rather than requiring administrators to hunt for issues, is in definition now. 

Beyond security and reliability, the feedback on email, AI, and the broader user experience is shaping what comes next. Business Email integration, which will be a meaningful upgrade to the webmail experience that end users have long needed, is on track. 

An AI Support Assistant built into the GUI, focused on the practical, log-reading and diagnostic use cases that respondents asked for specifically, is also scheduled. We’re approaching AI capability the way the survey asked us to: opt-in, operationally useful, and grounded in actual server management workflows rather than generative features added for their own sake. 

For the full picture of what’s planned, in progress, and under consideration, the roadmap is live at features.cpanel.net. 

Thank You 

3,300 responses is a meaningful commitment of time from people. We genuinely appreciate every one of them. 

The goal of this survey is to make better decisions about what we build, and the 2025 data gives us a clearer signal than we’ve had before. The priorities are not ambiguous: security tooling, backup management, email modernization, a more responsive UI, and AI that earns its place by solving real operational problems. 

We’ll share updates as work progresses. If you want to go deeper on any of the roadmap items, or if you’re one of the 842 respondents who opted in to speak with a Product Manager, watch your inbox. 

Want a more direct hand in what we build next? Sign up for our UX program and help test new features before they ship.

For the current roadmap: features.cpanel.net. 

The post cPanel & WHM 2025 Survey Results: What 3,300 of You Told Us appeared first on cPanel.

AI Is the #1 Panel Innovation Gap

According to the report, when hosting providers were asked where control panels should innovate most, 36% chose integrated AI and automation tools. That ranked ahead of advanced security and compliance (19%), better WordPress and CMS integrations (17%), centralized server and license management (15%), and developer tools and API access (6%). AI and automation outranked every other category combined.

In the next 2-3 years, where do you see the BIGGEST innovation opportunities, for control panels and web infrastructure software?

For a mid-sized provider, this data point matters because it reflects what the market expects from the platforms you operate on. The providers evaluating and purchasing control panels are increasingly making those decisions based on whether AI is embedded in the platform itself.

Where Providers Are With AI Today

The report shows that AI adoption in hosting operations is real but still early: 36% already use AI in customer support, primarily through chatbots and reply suggestions. 30% use AI for server monitoring and optimization, including anomaly detection and smart alerting. 29% deploy AI for cybersecurity threat detection. 27% have not implemented any AI solutions yet. 

In which areas have you already implemented AI solutions successfully in your operations?

The providers who have started concentrated their initial efforts in support, security, and monitoring, the three areas where operational pressure is highest and the return on automation is most immediate. More than a quarter of the industry has not started at all, which means the competitive window for early adopters is still open. 

The Operational Pressure Driving AI Demand

The AI demand data maps directly to where hosting teams are spending the most time and absorbing the most cost. 

The report identifies the four largest consumers of support time across the industry: email problems including spam, blacklisting, and deliverability (42%), CMS and application issues such as plugin conflicts and installation help (39%), performance issues including slow sites (35%), and security incidents including hacked sites and malware (35%). 

Which of the following topics consume the most support time on a regular basis?

On the security side specifically, 53% of providers cite outdated software and plugins as their biggest security challenge. 51% deal with malware and ransomware. 40% face DDoS attacks. 36% report bot traffic consuming server resources. 

These are not edge cases. They are the daily operational reality for the majority of hosting providers, and every one of them is a candidate for AI-assisted automation built directly into the control panel. 

What Providers Want AI to Do Inside Their Panel

When asked which AI capabilities would create the most value for their business, providers gave operationally grounded answers: automated security and malware detection (65%), predictive server performance monitoring (48%), AI-driven customer support tools (37%), AI-assisted onboarding and migrations (23%), and billing anomaly detection (19%). 

The top two requests are both about catching problems before they reach the customer. Providers are not asking for AI to do new things. They are asking for AI to handle the problems they already manage manually, but earlier, faster, and more consistently. 

Which of the following AI-enabled capabilities would create the most value for your business?

65% want automated malware detection because 53% are dealing with outdated plugin vulnerabilities and 51% with malware. 48% want predictive performance monitoring because 35% of support time goes to slow site issues. 37% want AI-driven support tools because routine queries consume team capacity that could go toward complex issues. 

The connection between where support time goes and where providers want AI deployed inside the panel is the clearest signal in the data about where to start. 

What cPanel Is Building

The specific AI capabilities currently in development at cPanel are designed to address the support and troubleshooting patterns the survey identifies. The details are covered in this overview of AI features coming to cPanel, but the two core capabilities worth understanding are: 

An embedded AI support assistant that lives inside the cPanel interface. Users can ask questions in plain language and receive contextual guidance, step-by-step workflow direction, and relevant documentation without opening a support ticket. For providers, this means fewer repetitive tickets reaching the support queue and a more consistent experience for end users. 

MCP-based troubleshooting integration that enables AI systems to interact with cPanel through a structured protocol. In practice, that means instead of manually checking Apache error logs, PHP configuration, DNS resolution, and file permissions when a site returns a 500 error, an AI-assisted workflow can check those in sequence and surface the likely cause.

Diagnostic workflows become standardized across environments, common issues get identified with less manual effort, and the time per investigation drops. For a mid-sized provider where different team members diagnose the same issue differently, that consistency has direct operational value. 

Which of the following security challenges create the most operational overhead or risk for your business?

Both capabilities work within existing permission models and administrative controls, which matters for providers managing multi-tenant environments. The effectiveness of these AI capabilities will also grow as the platform deepens its awareness of the application layer, particularly CMS environments, given that 39% of support tickets originate there.

The more context AI has about what is running inside a server, the more accurately it can diagnose issues and reduce the support burden that sits in the application layer today. 

What This Means if You Run cPanel

The survey data and the AI capabilities in development connect to specific operational realities that cPanel users deal with daily. Here is how. 

The four largest support drains in the industry, email (42%), CMS issues (39%), performance (35%), and security (35%), are the same categories that generate the highest ticket volume for cPanel-based hosting operations. The embedded AI support assistant is designed to intercept the routine queries within those categories before they become tickets.

When an end user asks “how do I create an email account,” “why is my website not loading,” or “where do I manage my DNS settings,” the assistant provides contextual, step-by-step guidance inside the interface rather than routing that question to your support team. For a provider handling hundreds of accounts, even a partial reduction in routine ticket volume translates directly into recovered team capacity. 

The MCP troubleshooting integration changes how your support team investigates issues. Today, diagnosing a 500 error typically means a support engineer manually reviewing Apache error logs, checking PHP configuration, verifying DNS resolution, inspecting file permissions, and piecing together a root cause across multiple tools and log files. Different team members approach that investigation differently, which creates inconsistency in resolution time and quality.

MCP standardizes that sequence. An AI-assisted workflow checks each diagnostic step in order and surfaces the probable cause, giving your team a consistent starting point for every investigation regardless of who picks up the ticket. For a team of five to fifteen people managing a growing fleet, that consistency compounds into a meaningful operational improvement over time. 

48% of providers want predictive performance monitoring, and the diagnostic infrastructure being built through MCP creates a natural foundation for that capability. The same structured access to server-level data that enables faster troubleshooting also generates the historical patterns needed to identify degradation before it produces incidents.

For a mid-sized provider, the operational value is direct: a performance issue on a shared server affects multiple customers simultaneously, generating a cluster of tickets that a lean team has to resolve under pressure. Catching the early signals of resource exhaustion, abnormal I/O patterns, or application-level slowdowns before they reach the customer is the difference between proactive service delivery and reactive firefighting. 

Both capabilities are in active development, and providers can influence what gets built through the cPanel feature request portal. In the meantime, there are things worth doing now that position your team to adopt these tools with minimal friction when they become available. Documenting the ten most common support scenarios your team handles, including the exact diagnostic steps and resolution paths, creates an internal knowledge base that reduces variation today and becomes the foundation for AI-assisted workflows when they arrive.

Standardizing how your team approaches recurring issue categories, particularly around email configuration, WordPress troubleshooting, and performance investigation, means the transition to AI-assisted diagnostics is a refinement of existing processes rather than a new way of working. 

84% of providers rank automation among their top factors when evaluating server software, with 55% selecting the highest possible rating. AI builds on that automation foundation by handling the variable, unpredictable workflows that automation alone cannot address: identifying which server is trending toward resource exhaustion, identifying which customer site is running components with known vulnerabilities, identifying which support ticket can be resolved through guided self-service rather than human investigation. The support drain data tells you where to look first. The AI capability demand data tells you what comes next. 

From Operational Efficiency to Competitive Advantage

53% of providers expect AI-driven automation to have the biggest impact on hosting in the period ahead. The providers who will compete most effectively are those who build AI into their operations one use case at a time, starting where the data shows the most pain, and measuring the return clearly enough to justify the next step.

Which of these trends do you anticipate having the biggest impact on the hosting industry in 2026?

At cPanel, that is the framing shaping how the platform continues to evolve: helping providers manage infrastructure more intelligently, at the scale and complexity modern hosting demands.

The post From Automation to Intelligence: What Hosting Providers Expect from AI appeared first on cPanel.

This release focuses on streamlining certificate lifecycle management, simplifying day-to-day server administration, and improving visibility and control across hosting environments.

Top Release Highlights

Strengthening Security With Integrated Firewall Management

ConfigServer Security & Firewall (CSF) is now delivered through cPanel’s signed update pipeline, replacing the previous Web2Web distribution method. Existing CSF installations are automatically migrated, and Security Advisor now recommends cPanel-managed CSF when it is not installed.

This change ensures firewall updates are verified, consistent, and seamlessly integrated into standard cPanel updates. By removing the need to manage external update sources, teams can maintain a more consistent security posture across their environments. Teams should verify that CSF is active and managed via cPanel across their servers.

Preparing for the Future of SSL

Industry standards for SSL/TLS certificates are evolving, with certificate lifespans expected to decrease significantly over time.

cPanel & WHM v136 introduces native support for short-lived SSL certificates, with automated issuance and renewal via the ACME protocol. This applies across all SSL types, including paid certificates.

With automation handling frequent renewals, teams can manage certificate lifecycles more reliably while reducing the risk of unexpected expirations. Review your SSL configuration to ensure ACME-based automation is enabled where applicable.

Simplifying SSL Management

SSL management in cPanel is now more streamlined. Three separate SSL-related interfaces have been consolidated into a single unified SSL/TLS management page.

This reduces navigation friction, simplifies certificate workflows, and helps minimize configuration errors for end users. Update any internal processes or documentation that reference the previous SSL interface.

Improving Visibility and Control Across Server Environments

Several updates in v136 focus on making server management more consistent and easier to operate at scale.

Server-Wide PHP Error logging

Administrators can now configure PHP error logging across all accounts from a single WHM interface. This enables consistent logging configurations and supports faster troubleshooting across environments. Review and standardize your PHP logging settings at the server level.

Enhanced Log Retention Controls

New controls in WHM and cPanel provide greater visibility into web server log storage and lifecycle. This helps teams manage disk usage more effectively while aligning with logging and compliance requirements. Audit your current log retention settings and adjust them based on your storage and compliance needs.

Improved PHP Version Visibility

End-of-Life (EOL) and Hardened PHP versions are now clearly distinguished in the interface. This makes it easier to identify unsupported versions and prioritize upgrades based on risk. Review your servers for EOL PHP versions and plan upgrades where necessary.

MariaDB 11.8 support

MariaDB® 11.8 is now supported and available as an option in WHM’s Upgrade Database Version interface.

This gives teams more flexibility when managing database versions and planning upgrades across their environments. Review your current database versions and plan upgrades where appropriate.

Strengthening Session Security

Logging out via WebPros Account now fully terminates the global SSO session, rather than only ending the local cPanel or WHM session.

This aligns logout behavior with expected SSO standards and reduces the risk of lingering authenticated sessions.

Platform Updates: Final Support for Ubuntu 22.04 LTS

cPanel & WHM v136 is the last version to support Ubuntu 22.04 LTS. Customers currently running Ubuntu 22.04 should plan and initiate migration to Ubuntu 24.04 LTS using the ELevate upgrade path before upgrading beyond this release.

cPanel & WHM v136 supports:

• AlmaLinux 8, 9, and 10
• CloudLinux 8, 9, and 10
• Ubuntu 24.04 LTS

Built for More Consistent, Scalable Operations

cPanel & WHM v136 brings together improvements that make it easier to operate, secure, and scale hosting environments.

By integrating security updates, automating high-frequency tasks like SSL renewal, and centralizing configuration management, this release helps reduce manual work while improving consistency across systems.

Learn More

For full technical details, review the complete v136 release notes.

The post Introducing cPanel & WHM Version 136 appeared first on cPanel.

Once a verified and reproducible report was confirmed, our team made updates available within approximately 28 hours across all supported versions of the platform, as well as select legacy versions. As of today, over 98% of servers worldwide are running an updated version of cPanel & WHM. We continue to provide mitigation options for partners and customers who are unable to apply the update immediately. The complete update regarding patch coverage is listed in the following support article. 

We take security extremely seriously and recognize the urgency this created. We remain focused on supporting our partners and customers. 

What Was Addressed 

CVE-2026-41940 is an authentication vulnerability in cPanel & WHM’s session management layer. Two separate code paths write to session files on disk: one path included an input-sanitisation step; a second path, invoked during Basic authentication handling, did not. The absence of that sanitisation step on the second path created a condition under which a specially crafted request could result in an unauthenticated session being treated as authenticated, granting access without valid credentials. 

The vulnerability affects every version of cPanel & WHM after v11.40, and WP Squared up to v11.136.1.6. VulnCheck has assigned it a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 1 May 2026. No other WebPros products are affected.

For servers on versions that cannot yet be updated, the support article provides mitigation guidance including cpsrvd service port blocking and ModSecurity rule application. We have also published a detection script  that scans session files for the indicators of compromise associated with this attack. Note that, as of 1 May 2026, the script has been refined to remove an earlier false-positive on session.lock files.

How We Responded 

The following sequence reflects how the response unfolded on confirming the vulnerability. 

• 27 April, 10:47 CDT – Vulnerability confirmed and classified. Incident response initiated

• 28 April, 12:08 CDT – Support article (KB 40073787579671) published. Partner collaboration channels opened

• 28 April, 12:30 CDT – Code update merged into v138 and applied simultaneously across v136, v134, v126, v118, and v110

• 28 April, 16:19 CDT – Updated builds published across all supported tiers: LTS, STABLE, RELEASE, CURRENT, and EDGE. Approximately 28 hours from confirmation to general availability 

• 29 April 15:18 CDT – Comprehensive email issued to all partners and direct customers, alongside publication of the indicators-of-compromise detection script. A second coordinated email followed on 1 May with expanded version coverage and additional mitigation measures

From there, the work continued in parallel: back-ports for legacy and end-of-life versions, automated remediation tooling, and direct support for partners working through specific fleet configurations.  

Detection and Auto-Remediation Tooling

Two additional tools supported the broader response alongside the patches. 

The indicators-of-compromise detection script, available at https://support.cpanel.net/hc/en-us/articles/40073787579671 scans session files for attributes associated with this specific exploit. It was refined on 1 May to correct a false-positive on session.lock files identified by partners during their own fleet testing. Any server that was unpatched at any point during the incident window should be scanned using the current version of the script. 

Automated remediation tooling was deployed on our side to accelerate update adoption across the installed base, including a majority of affected builds, a number of end-of-life versions and a dedicated path for CL6/C6 environments accessible via run_security_update. This allowed us to drive patch coverage to over 98% of servers as of today without requiring manual intervention across every affected configuration. Coverage continues to expand through specific mitigation steps outlined in our support article. 

Updates for Legacy Versions  

In addition to all currently supported tiers, we delivered targeted updates for v86, v94, v102, v124, and v130, which have been outside standard support for some time, along with a dedicated update tier for CL6/C6 (CloudLinux 6) environments, available through the run_security_update autofixer.

Each of these required individual engineering work: targeted porting, version-specific validation, and full regression testing before release. 

Working Closely with Partners on Edge Cases 

The update coverage we can report today was built alongside our partners, not independently of them. Over the past week, hosting partners and server administrators have been active participants in the response, and we want to be specific about what that looked like. 

Testing the Detection Script Against Live Fleets 

Several partners ran the detection script across their server fleets in the days after publication and reported edge cases that had not surfaced in our own testing environment. This partner feedback is what produced the 1 May update to the script. Their environments effectively extended our validation coverage in ways that improved the quality of the tooling for everyone. 

Validating Update Behaviour on Non-Standard Configurations 

Pinned, locked, and version-restricted configurations do not always behave the way standard configurations do when an update runs. Partners with these environments worked directly alongside our engineering team to validate tooling behaviour against their specific setups, and to surface update blockers before broader rollout. Several of the back-ports for older version tiers were shaped directly by these conversations: partners described exactly what their fleet was running and why it could not move, and our team built the update path around that constraint. 

Coordinating Customer Communications 

A number of partners aligned their own customer communications with ours, requesting accuracy checks, version-specific guidance, and technical detail they could relay to their support teams. We supported each of these requests directly. The result was a more consistent message reaching downstream customers across a wide range of hosting environments. 

Surfacing Partner-Specific Update Blockers 

In several cases, partners identified conditions specific to their environment that prevented the standard update path from completing and brought them to our attention directly. Our team prioritised each one as part of the incident response rather than routing it through standard support. That prioritisation contributed directly to the pace at which update coverage moved. 

Further Context

During the course of April, we received separate reports regarding a possible pre-authentication issue in cPanel & WHM. For one of the two reports, our team engaged in follow-up correspondence with the person behind it to better understand, categorize and clarify the information provided. With the details available at that stage, we were unable to independently reproduce the reported behavior, and our initial assessment did not confirm a vulnerability. When the second report arrived with additional context, our team was able to reproduce and confirm the vulnerability the same day, and our incident response protocol began immediately.

What We Are Changing 

The following commitments reflect our focus on continuous improvements in security practices, to address an evolving threat landscape. 

Thank You 

Our customers, our partners and their customers, depend on this infrastructure, and that dependency carries a responsibility we take seriously. Our response has been to fix first, move quickly, provide clear and actionable communication, and commit to a continuous improvement in our processes to address a fast-changing threat landscape.  

To the partners who worked alongside our team this past week, testing tooling, working through non-standard configurations, aligning customer communications, and flagging issues as they found them: the update coverage we have achieved is a direct result of that collaboration. Thank you.

To the security community whose scrutiny has kept this incident in clear focus: that scrutiny is appropriate and it produces better outcomes. Thank you.

The support article at https://support.cpanel.net/hc/en-us/articles/40073787579671 remains the live operational reference and is updated continuously.

The post CVE-2026-41940: Response, Actions and Next Steps appeared first on cPanel.

Infrastructure is more complex. Support demands are higher. Users expect faster answers and more intuitive experiences. Yet most hosting workflows still rely on fragmented tools, manual troubleshooting, and reactive support models.

That model no longer scales.

cPanel is redefining the role of the hosting control panel, evolving it into an intelligent operations layer where assistance, troubleshooting, and system insight are built directly into the platform. This shift is not about adding AI features. It’s about embedding intelligence into the core of how hosting environments are managed.

According to the Web Hosting Trends Report 2026 by WebPros and CloudLinux, providers are increasingly prioritizing AI-driven tools to reduce operational overhead and improve support efficiency. cPanel is taking this a step further by integrating those capabilities directly into the control plane itself, where decisions are made and actions happen.

Core AI Capabilities in cPanel

cPanel is introducing a new layer of AI-powered capabilities designed to fundamentally change how hosting environments are operated and supported at scale.

Instead of relying on external tools, documentation, or manual investigation, users can now interact with their environments in real time, getting answers, guidance, and diagnostics directly within cPanel. At a practical level, this means:

• Instant, contextual answers without leaving the interface
• Guided workflows for common and complex tasks
• Faster, more accurate issue identification
• Standardized, repeatable troubleshooting processes

Together, these capabilities reduce the time and effort required to manage hosting environments, while improving consistency across users, teams, and infrastructure.

This new model is powered by two core innovations:

• An embedded AI assistant, designed to guide users and reduce dependency on support
• Context-aware troubleshooting through MCP, enabling structured, scalable diagnostics across environments

These are not standalone features. They represent the foundation of a broader shift toward intelligent, self-service hosting operations, built directly into cPanel.

AI-Powered In-Product Assistant

One of the most impactful enhancements planned in the roadmap is an embedded AI support experience directly within cPanel.

Ask Questions in Plain Language

This in-product support assistant helps users navigate tasks, resolve issues, and understand features without leaving the interface. Instead of relying on trial and error, users can simply ask questions in plain language, such as:

• How do I create an email account?
• Why is my website not loading?
• Where can I manage my domain settings?

For example, a user troubleshooting a website issue can ask what’s wrong, receive a simple checklist, and navigate to the relevant tools without opening a support ticket.

Step-by-Step Guidance Inside the Interface

The assistant responds with clear, contextual guidance, often pointing directly to the relevant tools or walking users through the next steps.

In its initial iterations, the focus is on:

• Answering “how-to” questions
• Guiding users through common workflows
• Helping troubleshoot basic issues
• Surfacing relevant documentation and tools

Reduced Dependency on Support

This means faster onboarding and less friction when using advanced features. For hosting providers, it helps reduce repetitive support requests and creates a more consistent support experience across customers.

As capabilities evolve, this assistant is expected to become a core part of how users interact with cPanel, making everyday hosting tasks simpler and more intuitive.

Context-Aware Troubleshooting with MCP

While the in-product assistant improves how users interact with cPanel, MCP integration improves how issues are diagnosed behind the scenes.

Faster Diagnostics with Context-Aware AI

MCP enables AI systems to interact with cPanel through a structured, standardized protocol, allowing consistent and repeatable troubleshooting workflows across environments.

This means:

• Logs and configurations can be reviewed faster
• Common issues can be identified with less manual effort
• Troubleshooting steps can be more consistent and repeatable

For example, instead of manually checking multiple systems, an AI-assisted workflow could help surface why a site is returning an error, highlighting potential causes, and suggesting the next steps to resolve it.

More Consistent Troubleshooting Workflows

For server admins and support teams, this reduces the time spent on routine investigations and helps standardize how issues are handled across environments.

Importantly, these capabilities are designed to operate within existing permission models and administrative controls. As with any system-level access, actions depend on the level of access granted. AI can assist with managing environments, but it operates with the same scope and responsibilities as the user or admin it represents. This means oversight remains critical, especially as AI-assisted workflows continue to evolve.

Here’s how it will operate:

Together, MCP integration lays the foundation for faster, more scalable support and operations within cPanel.

What This Means for You

These capabilities are designed to deliver measurable improvements across the hosting ecosystem.

For Hosting Providers

Greater operational scalability through reduced support volume and more efficient issue resolution.

For Server Admins

Faster diagnostics and reduced cognitive load when investigating issues across complex environments.

Across all users, the outcome is the same: less time spent figuring things out, and more time spent getting things done.

Help Define the Next Phase of cPanel

The evolution of cPanel is not happening in isolation. Feedback from hosting providers, developers, and end users continues to play a key role in shaping what gets built next.

As these AI capabilities take shape, there is an opportunity to directly influence how they evolve, whether it is suggesting new use cases, improving existing workflows, or prioritizing specific features.

Do you have a feature in mind? Submit it or vote on existing ideas to help shape what comes next in cPanel.

Your feedback can help define the next phase of innovation in cPanel.

This is a step toward a more intelligent, more responsive cPanel experience, built around how hosting is actually used today.

The post The Next Evolution of cPanel: Built-In AI for Faster, Smarter Hosting Management appeared first on cPanel.