CPanel and WHM Authentication Bypass – CVE-2026-41940(labs.watchtowr.com)
69 pointsby zikani_037 hours ago11 comments
  • yabones4 hours ago
    Oooooh that's really bad. Wordpress on Cpanel sites is like the Dark Matter of the internet, it's everywhere and you don't see it until something bad happens. Libations for the sysadmins patching & cleaning up this mess.
    • xtracto3 hours ago
      At the rate we are going, we will all go back to publish HTML website like in Geocities times.
      • anakaine2 hours ago
        Conceptually, static sites are probably not too far off this.
  • superasn4 hours ago
    Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug.

    Session handling, auth, crypto, password hashing etc - all these are the exact areas where you should be the most allergic to rolling your own. Not because you're not smart enough, but because a simple bug like sanitizing in the wrong place and the failure is catastrophic like in this instance.

    Use boring, proven, widely-audited solutions. Save your creativity for the actual problem you're solving.

    • bananamogul4 hours ago
      “And the best code in this case is code you didn't write as PHP's session handler is battle-tested”

      cPanel is written in perl.

      • superasn3 hours ago
        Oh you're right to push back. I just love saying this nowadays :P Anyway, I haven't used these languages in a long time but the code looked like php to me, though I did notice the .pm file extension and wondered where I've seen it before.
    • shawnz3 hours ago
      cPanel is 30 years old, are you saying it's not battle tested, boring, proven, and widely audited?

      In fact PHP is only a few months older than it.

    • ryandrake4 hours ago
      I don't even know why you'd want to re-implement this stuff, too. It's not exciting or sexy work. It's like time parsing, time zone handling, leap years... Why would you want to inflict that on yourself? You will 100% not handle every edge case, and you will 100% get time and time zone handling bugs.
  • debo_4 hours ago
    I wonder how much of the web still runs on perl. I miss it sometimes.
    • mushufasa4 hours ago
      I used to help nonprofits and small businesses build websites. Process always went like 1. buy domain, 2. buy a shared hosting provider that one-click-installs Wordpress, 3. use a theme to begin editing the website. Often, I would also use the email included with that hosting provider for the firm.

      ALL of that goes through cpanel, for every shared hosting provider I can ever remember using. Even if the stuff happening on those servers didn't use perl, cpanel itself -- the admin of everything provided for that domain by the hosting provider -- it's a huge surface area.

      • debo_2 hours ago
        Yeah cpanel navigation is still wired into my brain stem as well.
  • amluto3 hours ago
    I like how the vulnerability is in the path that (a) attempts to write the password in reversibly encrypted form to disk [0] and (b) has a weird fallback path that writes it in clear text. Sigh.

    [0] cPabel seems to be from 1996. We’ve known this is a mistake since before 1996.

  • 3 hours ago
    undefined
  • whalesalad3 hours ago
    > this vulnerability affects - and we cannot stress this enough - all currently supported versions of cPanel & WHM

    yikes. https://www.shodan.io/search?query=basic+realm%3D%22cPanel%2...

  • Loudergood4 hours ago
    That's gonna pair really well with this.

    https://copy.fail

    • yunnpp4 hours ago
      Why? This one gives you a root shell directly, no need for an LPE.
  • ls6124 hours ago
    Something that is starting to concern me with the flood of cyber chaos in the past couple of months is my homelab. Currently I do not have it set up to be accessible outside the local network and then add it and all my other devices to my tailnet to facilitate remote access (via an exit node on my local network). On top of that TrueNAS doesn't seem to have the best update cadence so I'm worried about having a system with known vulnerabilities only protected by not being accessible remotely in theory.
  • mushufasa4 hours ago
    Oh dear.
  • 0xbadcafebee4 hours ago
    Y'know what would help protect those internet buildings from falling on people? A software building code
    • edg50003 minutes ago
      Really not looking forward to a regulated software industry. It will cause a lot of gatekeeping and bureaucracy. It's one of those things that may seem good, but in practice, it's pure waste in every way imaginable. Will just lead to exclusivity, gatekeeping and artificial friction. This is a hill I'm willing to die on. Those making software have plenty of incentives to make it good, and bad software is punished already to the fullest extend (because it's not fun to get compromised or your reputation ruined; this is a natural incentive)