Acronis Backup Plugin CVE-2026-87886 LPE to Root on cPanel/WHM/Plesk

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

This rule detects scenarios where a web server process or control panel utility (such as cPanel or Plesk) appears to initiate a shell process (sh, bash, dash) as the root user. This behavior is highly indicative of a compromise where an attacker has achieved command execution in an elevated context following an exploit against a web application or control panel interface.