A critical vulnerability in cPanel’s CalDAV and CardDAV service allows any cPanel hosting account holder to execute code as root, leading to full server control. Additionally, a second bug in the WP Toolkit plugin enables account holders to modify databases belonging to other accounts. cPanel has released fixed versions for both issues, urging users to update immediately to prevent unauthorized access and privilege escalation.