Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPanel and WHM Authentication Bypass – CVE-2026-41940

labs.watchtowr.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#21

Post by debo_ »

mushufasa wrote: post #6
debo_ wrote: post #3

I wonder how much of the web still runs on perl. I miss it sometimes.

I used to help nonprofits and small businesses build websites. Process always went like 1. buy domain, 2. buy a shared hosting provider that one-click-installs Wordpress, 3. use a theme to begin editing the website. Often, I would also use the email included with that hosting provider for the firm. ALL of that goes through cpanel, for every shared hosting provider I can ever remember using. Even if the stuff happenin…

Yeah cpanel navigation is still wired into my brain stem as well.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#22

Post by edg5000 »

0xbadcafebee wrote: post #2

Y'know what would help protect those internet buildings from falling on people? A software building code

Really not looking forward to a regulated software industry. It will cause a lot of gatekeeping and bureaucracy. It's one of those things that may seem good, but in practice, it's pure waste in every way imaginable. Will just lead to exclusivity, gatekeeping and artificial friction. This is a hill I'm willing to die on. Those making software have plenty of incentives to make it good, and bad software is punished already to the fullest extend (because it's not fun to get compromised or your reputation ruined; this is a natural incentive)

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#23

Post by skilled »

What a shame that I no longer have access to my teenage-level conscience, I am sallivating at the idea of going wild with this and the Copy Fail cve.

The potential here to do all kinds of manipulation for search engines / AI tools is enormous. Perhaps the more scary thought is that someone could easily make an agent that would exploit both bugs to wipe out servers.

Good on these companies to publish their findings straight away as I'd imagine that both bugs would have fetched quite a lot on the black market.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#27

Post by denkmoon »

edg5000 wrote: post #22
0xbadcafebee wrote: post #2

Y'know what would help protect those internet buildings from falling on people? A software building code

Really not looking forward to a regulated software industry. It will cause a lot of gatekeeping and bureaucracy. It's one of those things that may seem good, but in practice, it's pure waste in every way imaginable. Will just lead to exclusivity, gatekeeping and artificial friction. This is a hill I'm willing to die on. Those making software have plenty of incentives to make it good, and bad software is punished alre…

Not a very good one given the frequent data leaks from large companies. May not be fun but the bottom line continues along unabated.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#28

Post by stevekemp »

debo_ wrote: post #3

I wonder how much of the web still runs on perl. I miss it sometimes.

I still deploy a bunch of simple sites, built around the CGI::Application framework.

I understand how they work, I'm familiar with HTML::Template, and related modules, so I can hack up a quick interactive/dynamic site in a couple of hours.

They're no longer things I'd run on the public internet, but for quick internal things it's very easy to deploy a container with a perl backend.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#29

Post by londons_explore »

superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

I doubt the mantra of "don't roll your own Auth/crypto" - especially if it lives on a server where the code can't be inspected.

Sure, there will be more bugs in my code, but the attackers will be putting far more scrutiny into a widely used library.

Some deliberately hilariously weak auth I built decades ago is only just now starting to get broken into by AI bots, whereas any vulnerable wordpress was broken into within days.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#30

Post by hparadiz »

superasn wrote: post #16
bananamogul wrote: post #10

Earlier quoted context omitted.

“And the best code in this case is code you didn't write as PHP's session handler is battle-tested” cPanel is written in perl.

Oh you're right to push back. I just love saying this nowadays :P Anyway, I haven't used these languages in a long time but the code looked like php to me, though I did notice the .pm file extension and wondered where I've seen it before.

PHP has built in session handling and the ability to store them to local, in memory, RDBMS database, or you can implement SessionHandlerInterface, SessionIdInterface with your own custom class.

It's probably the most battle hardened session system ever.

Post reply on HN