blog
Notes from the panel.
Product announcements and engineering notes on how CorePanel is built.
-
Four critical cPanel CVEs in 2026. We ran all four against CorePanel
CVE-2026-41940, 29201-29203, 58048 and 65643, explained for sysadmins — what each one really lets an attacker do, and what testing the same four classes found in our own panel.
Read → -
cPanel alternatives in 2026: prices, platforms, and where each one fails
Plesk, DirectAdmin, CloudPanel, CyberPanel, HestiaCP and CorePanel compared on price, platform, mail, DNS and multi-tenancy — including where each one is the wrong answer.
Read → -
Self-hosting email in 2026: the mail server was never the hard part
Port 25, reverse DNS, the announced name and the IPv4/IPv6 coin flip decide whether your mail is accepted — not Postfix. What to check, and in what order.
Read → -
We had to build our own web server
CoreHttpd runs on an engine that spent six years in front of cPanel servers, protecting more than 800,000 domains — and it never runs as root.
Read → -
CSF is gone. Here's how to run a server firewall in 2026
ConfigServer shut down on 31 August 2025. Which half firewalld already replaces, the three mistakes that lock you out, and who does lfd's job now.
Read → -
An Elementor site, measured: the cache buys visitors, HTTP/3 buys seconds
A real Elementor site on a 2-vCPU server, measured: the page cache took 400 simultaneous visitors from a queue to a shrug, HTTP/3 halved the wait, and WebP turned a 14.3 MB page into 75 KB.
Read → -
WebP without a plugin: what it saves, and why on-the-fly conversion is a trap
WebP cuts image weight 50–87% on real files. Why most WordPress sites still don't serve it, why converting per request can't work, and how CoreHttpd fixes it.
Read → -
WordPress served without PHP: 1.6 ms instead of 248 ms
A WordPress site with 400 posts on a 2-vCPU server, measured with the dynamic page cache off and on: TTFB, CPU per page view and pages served per second.
Read → -
Your cPanel license costs more than your server
cPanel's 2026 list price starts at $29.99 a month for a single account. What that buys, what it doesn't, and how to move a whole server to a free panel.
Read → -
Announcing CorePanel Personal — free, forever
CorePanel Personal is free forever and ships the complete core hosting stack for RHEL: CoreHttpd, PHP, MariaDB, mail, DNS, SSL and local backups.
Read → -
True user isolation, explained
Why 0700 permissions and dedicated PHP-FPM pools mean one compromised site can't take the whole server with it.
Read →