CPanel and WHM Authentication Bypass – CVE-2026-41940
11–20 of 64 posts
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#12That's gonna pair really well with this. https://copy.fail
Why? This one gives you a root shell directly, no need for an LPE.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#13Something that is starting to concern me with the flood of cyber chaos in the past couple of months is my homelab. Currently I do not have it set up to be accessible outside the local network and then add it and all my other devices to my tailnet to facilitate remote access (via an exit node on my local network). On top of that TrueNAS doesn't seem to have the best update cadence so I'm worried about having a system with known vulnerabilities only protected by not being accessible remotely in theory.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#14Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…
cPanel is 30 years old, are you saying it's not battle tested, boring, proven, and widely audited?
In fact PHP is only a few months older than it.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#15[deleted]
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#16Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…
“And the best code in this case is code you didn't write as PHP's session handler is battle-tested” cPanel is written in perl.
Oh you're right to push back. I just love saying this nowadays :P Anyway, I haven't used these languages in a long time but the code looked like php to me, though I did notice the .pm file extension and wondered where I've seen it before.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#17> this vulnerability affects - and we cannot stress this enough - all currently supported versions of cPanel & WHM
yikes. https://www.shodan.io/search?query=basic+realm%3D%22cPanel%2...
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#18Oooooh that's really bad. Wordpress on Cpanel sites is like the Dark Matter of the internet, it's everywhere and you don't see it until something bad happens. Libations for the sysadmins patching & cleaning up this mess.
At the rate we are going, we will all go back to publish HTML website like in Geocities times.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#19I like how the vulnerability is in the path that (a) attempts to write the password in reversibly encrypted form to disk [0] and (b) has a weird fallback path that writes it in clear text. Sigh.
[0] cPabel seems to be from 1996. We’ve known this is a mistake since before 1996.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#20Oooooh that's really bad. Wordpress on Cpanel sites is like the Dark Matter of the internet, it's everywhere and you don't see it until something bad happens. Libations for the sysadmins patching & cleaning up this mess.
At the rate we are going, we will all go back to publish HTML website like in Geocities times.
Conceptually, static sites are probably not too far off this.