Security Roundup August 2026: cPanel, Zimbra, vCenter and a Ransomware Record

August 2026 was a hard month for server administrators. Hosting panels, mail servers, virtualization platforms and VPN appliances all received critical fixes, and several flaws were exploited almost immediately. At the same time, ransomware attacks hit a new monthly record.

Below is a summary of what matters most for businesses and server operators in Indonesia, ordered from most to least urgent.

This month’s priorities

Product	Flaw	Status	Action
cPanel & WHM	CVE-2026-58048, CVE-2026-65643	Critical, can lead to root	Update to the latest build
Zimbra	CVE-2026-73570	Exploited, 270+ servers breached	Update to ZCS 10.1.20
VMware vCenter	CVE-2026-59310	Mass exploitation, ending in ransomware	Apply VMSA-2026-0006
Windows	CVE-2026-68820, CVE-2026-62878	Exploited zero-day, wormable DNS Server bug	Install the August updates
Citrix NetScaler	CVE-2026-8452	Exploited, web shells planted	Update per CTX696604
Cisco ASA/FTD	CVE-2026-20349	Exploited to crash firewalls	Apply the hot fix

cPanel & WHM: two critical flaws in one month

For VPS owners and shared hosting providers, this is August’s most important news.

• CVE-2026-58048 (CVSS v4 9.4, released 4–5 August). Renaming a database drops its SQL mode, so statements can run in the root database context. The same release fixed CVE-2026-58047, request smuggling in cpsrvd that can leak other users’ credentials on shared servers. Fixed in cPanel & WHM 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32.
• ConfigServer Security & Firewall (CSF) 16.20-1 and earlier also had flaws that could grant root access. They are fixed in 16.30-1.
• CVE-2026-65643 (27 August). A cPanel user who can add parked or addon domains can create arbitrary files and run code as root. cPanel rates it critical. One user on the cPanel forum reported a compromise on 25 August, although cPanel has not confirmed this flaw was the cause.

Action: run /scripts/upcp --force, make sure your cPanel version is on a supported tier, and update CSF.

Zimbra breached through SNMP

CVE-2026-73570 lets an unauthenticated attacker run system commands as the zimbra user through a crafted SMTP message. It only applies when the optional zimbra-snmp package is installed and SNMP notifications are enabled, which is not the default.

The impact is still real. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 21 August, and Shadowserver counted 274 compromised servers on 22 August, with at least 8,200 more still unpatched.

Action: update to ZCS 10.1.20 or later. Check whether SNMP notifications are enabled, and review files created by the zimbra user in the last 30 days in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/.

Many Indonesian companies still self-host Zimbra Open Source. If yours does, this is a reminder that mail servers need a regular patch schedule.

VMware vCenter: from vulnerability to ransomware

CVE-2026-59310 (CVSS 9.8 according to The Hacker News) is a directory traversal in the vCenter Syslog Server component that allows unauthenticated code execution. Broadcom disclosed it on 29 July in VMSA-2026-0006. Exploitation began around 3 August, and by 7 August 361 victim IP addresses in 47 countries had been compromised.

The attackers installed reverse_ssh, web shells and rogue SSO admin accounts. At some victims they also ran a Babuk-derived locker on ESXi hosts. A related authentication bypass, CVE-2026-59309, had been exploited since 1 August.

Action: patch now, because Broadcom offers no workaround. Look for unknown SSO admin accounts and suspicious outbound connections since early August. The case also shows why backups should live outside the virtualization platform itself.

August Patch Tuesday: a zero-day and a DNS Server bug

Microsoft fixed roughly 400 CVEs on 11 August (outlets report slightly different totals). The priorities:

• CVE-2026-68820, a zero-day in AFD.sys (WinSock) already exploited to escalate privileges to SYSTEM. Check Point linked it to a North Korean group.
• CVE-2026-62878, a stack overflow in Windows DNS Server that allows remote code execution with no authentication and no user interaction. Security Affairs calls it wormable.

In addition, the SharePoint authentication bypass CVE-2026-55040, already fixed in July, began to be exploited after a proof of concept was published on 13 August.

Action: install the August updates, starting with DNS servers and on-premises SharePoint. Do not expose SharePoint directly to the internet.

VPN appliances: Citrix and Cisco

• Citrix NetScaler, CVE-2026-8452. This SAML flaw was treated as a denial-of-service bug when it was patched on 30 June. After watchTowr published an exploitation chain on 14 August, attackers used it to plant web shells (x.php, z.php). CISA added it to KEV on 26 August. Fixed in 14.1-72.61, 13.1-63.18 and 13.1-37.272.
• Cisco ASA/FTD, CVE-2026-20349. A crafted HTTP request can reboot the firewall without authentication. It affects devices with Remote Access VPN, SSL VPN or ZTNA enabled. Cisco has released hot fixes and there is no workaround.

Linux servers: update the kernel

The kernel flaw CVE-2026-53362 (CVSS 7.8) in the IPv6 path lets an unprivileged local user corrupt memory. Several third-party trackers list it as exploited. Fixes are in kernels 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3. Update and reboot, especially container hosts and multi-user servers.

Southeast Asia: old flaws still work

A Chinese-speaking group used the ownCloud flaw CVE-2023-49105, patched back in 2023, to steal about 176 files from a research body in the Philippines. It also attacked a WordPress site through the LiteSpeed Cache plugin (CVE-2024-28000). The lesson: old, unpatched flaws remain an easy way in.

DDoS trends: Indonesia is a top-3 attack source

Cloudflare’s DDoS report for the first half of 2026 (13 August) found that:

• 90.6% of network-layer attacks ended in under 10 minutes, too fast for a manual response.
• Attacks above 1 Tbps grew sharply.
• DNS floods and DNS amplification made up 34.3% of network-layer attacks.
• Indonesia ranked third as a source of attacks, after Brazil and the United States.

DDoS protection therefore needs to be always on and automatic, not switched on after an attack starts.

Ransomware sets a record

Comparitech counted 997 ransomware attacks in August, up 23% from July and above the previous record. The most active groups were Qilin and The Gentlemen. No Indonesian victims appeared among the confirmed cases.

In Indonesia: BSSN warnings

• 6 August. BSSN, Indonesia’s national cyber agency, said it sees an average of 182 potential cyber attacks per second, and recorded about 5.16 billion traffic anomalies in 2025. It urged banks to treat security as an investment rather than a cost.
• 13 August. BSSN warned that AI makes attacks cheaper, more automated and more convincing. Financial institutions must have an incident response team (CSIRT) registered with BSSN.

For context, Government Regulation (PP) 33/2026 on personal data protection was enacted in July and takes effect on 16 January 2027. See our guide to PP 33/2026.

Quick checklist

1. Update cPanel & WHM and CSF.
2. Update Zimbra to 10.1.20 or later.
3. Patch vCenter and check for signs of compromise.
4. Install August Patch Tuesday, DNS Server and SharePoint first.
5. Update NetScaler and Cisco ASA/FTD firmware.
6. Update the Linux kernel and reboot.
7. Make sure you have a backup that is separate from your main server and that restores have been tested.

How Cloudku can help

Patching comes first, but no system is free of flaws. Cloudku Cyber Protection provides backups kept separate from your servers together with anti-malware protection, so your data can still be restored if a server is breached or hit by ransomware. For short, fast DDoS bursts, Cloudku DDoS Protection filters traffic automatically through filtering nodes in Indonesia.