Acronis has warned that a vulnerability in its Backup plugin for cPanel and WHM has been exploited in targeted attacks. Hosting providers and server administrators should treat the update as a high-priority maintenance task.

What is the issue?

The affected integration connects cPanel and WHM with Acronis Cyber Protect Cloud for server, account, file, database, and mailbox backup and recovery. A low-privileged foothold on a Linux server may allow an attacker to increase permissions and reach sensitive hosting data.

Who should check?

• Hosting providers running the Acronis Backup plugin for cPanel and WHM.
• Administrators managing shared, reseller, VPS, or dedicated Linux servers with the plugin installed.
• Teams using the related Acronis extension in Plesk environments.

Recommended response

1. Record the installed plugin and protection-agent versions on every affected server.
2. Apply the vendor-provided fixed release through the supported update process.
3. Review privileged-account activity, plugin logs, recent file changes, and unexpected scheduled tasks.
4. Rotate exposed credentials and API tokens if suspicious activity is found.
5. Confirm that backups are isolated, encrypted, recent, and restorable.

Why patching matters

Backup integrations often have access to high-value data and recovery operations. Keeping the plugin and its protection agent current reduces the chance that a compromised hosting account can become a broader server incident.

Sources: The Hacker News report, Acronis release notes, and BleepingComputer analysis.