CPanel and WHM Authentication Bypass – CVE-2026-41940 • Hacker News Board

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug.

Session handling, auth, crypto, password hashing etc - all these are the exact areas where you should be the most allergic to rolling your own. Not because you're not smart enough, but because a simple bug like sanitizing in the wrong place and the failure is catastrophic like in this instance.

Use boring, proven, widely-audited solutions. Save your creativity for the actual problem you're solving.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#6

Post by mushufasa » Fri, May 01, 2026, 1:28 AM UTC

debo_ wrote: post #3

I wonder how much of the web still runs on perl. I miss it sometimes.

I used to help nonprofits and small businesses build websites. Process always went like 1. buy domain, 2. buy a shared hosting provider that one-click-installs Wordpress, 3. use a theme to begin editing the website. Often, I would also use the email included with that hosting provider for the firm.

ALL of that goes through cpanel, for every shared hosting provider I can ever remember using. Even if the stuff happening on those servers didn't use perl, cpanel itself -- the admin of everything provided for that domain by the hosting provider -- it's a huge surface area.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#7

Post by yabones » Fri, May 01, 2026, 1:29 AM UTC

Oooooh that's really bad. Wordpress on Cpanel sites is like the Dark Matter of the internet, it's everywhere and you don't see it until something bad happens. Libations for the sysadmins patching & cleaning up this mess.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#8

Post by Loudergood » Fri, May 01, 2026, 1:32 AM UTC

That's gonna pair really well with this.

https://copy.fail

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#9

Post by ryandrake » Fri, May 01, 2026, 1:36 AM UTC

superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

I don't even know why you'd want to re-implement this stuff, too. It's not exciting or sexy work. It's like time parsing, time zone handling, leap years... Why would you want to inflict that on yourself? You will 100% not handle every edge case, and you will 100% get time and time zone handling bugs.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#10

Post by bananamogul » Fri, May 01, 2026, 1:37 AM UTC

superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

“And the best code in this case is code you didn't write as PHP's session handler is battle-tested”

cPanel is written in perl.