Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPanel and WHM Authentication Bypass – CVE-2026-41940

labs.watchtowr.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#41

Post by nirava »

dijit wrote: post #32
caspper69 wrote: post #25

This flurry of activity is certainly going to have people be more apprehensive about unproven software that may be of dubious prominence. My question amid all of this is who else knew about these long-standing vulnerabilities?

cPanel is just about as far away from “unproven” as possible.

at the same time, I've never had any faith in that software.

maybe because of it's association with really cheap, buggy hosts i explored in my teenage years. maybe because of their largely unnecessary complications (except enterprise maybe). maybe because of the tendency of large bloated depressing organizations to use these even in places they shouldn't.

not that many software have faith in are faring any better in this cve-storm.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#42

Post by q0uaur »

ls612 wrote: post #13

Something that is starting to concern me with the flood of cyber chaos in the past couple of months is my homelab. Currently I do not have it set up to be accessible outside the local network and then add it and all my other devices to my tailnet to facilitate remote access (via an exit node on my local network). On top of that TrueNAS doesn't seem to have the best update cadence so I'm worried about having a system…

definitely don't expose any management interfaces to the open internet.

personally, i manage my homelab through ssh via the commandline, and key-based ssh auth is secure enough for my threat model (i am considering switching the entrypoint machine to a BSD though, to avoid the kind of bugs distros sometimes introduce).

but a webserver and a few containerized services seem pretty low risk to me, so i do have a few of them exposed via reverse proxy. The more sensitive one behind Authelia via the forward-auth pattern, which i feel like is a really good fit for homelabs.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#43

Post by christophilus »

TZubiri wrote: post #35
superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

But it's not the same thing every time, for example if you had written 'your own' http request you wouldn't habe been hit by the axios vuln. If you rolled your own crypto and didn't install AF_ALG, you would have avoided copy fail. Even in this case if you had implemented your own control panel, you wouldn't be hit. Actually roll your own, don't add dependencies

Well, I tend to fall on your side of this, but doing this probably means you’re equally or more insecure and just won’t know it until you’re hacked. That said, I have written my own auth and session layers numerous times. My needs are generally simple, so getting it correct isn’t too hard.

When you pull in a generic auth or session library, you pull in a “can do everything” module rather than a “can do this one specific thing” module. So, your attack surface grows as do your odds of misconfiguration.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#44

Post by ChrisMarshallNY »

shawnz wrote: post #14
superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

cPanel is 30 years old, are you saying it's not battle tested, boring, proven, and widely audited? In fact PHP is only a few months older than it.

30 years isn't really a good thing, here.

I've been coding for more than 40 years, and I probably only took security seriously, in the last 25 or so.

In fact, in Ye Days of Yore, we often deliberately coded in unsecured stuff, for convenience.

Look at some of the old Apple Systems (pre-OS X), to see some stuff that would make secops people defecate masonry.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#45

Post by carlosjobim »

0xbadcafebee wrote: post #31
edg5000 wrote: post #22

Earlier quoted context omitted.

Really not looking forward to a regulated software industry. It will cause a lot of gatekeeping and bureaucracy. It's one of those things that may seem good, but in practice, it's pure waste in every way imaginable. Will just lead to exclusivity, gatekeeping and artificial friction. This is a hill I'm willing to die on. Those making software have plenty of incentives to make it good, and bad software is punished alre…

Yeah, I hate all those terrible regulations that keep people from burning alive in their homes too. Godddamn goverment saving lives, it's so slightly annoying. Wait. Wasn't there a whole group of people who thought this way recently? Wasn't it called the Department of Government Efficiency? Wasn't it led by a rich tech bro who wants to live on Mars? Didn't they get disbanded because it was a bunch of armchair experts…

Governments have killed 10-100 times more people than they have protected with regulations.

Not even natural disasters or disease can compete with governments when it comes to mass killings at enormous scales and boundless cruelty.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#46

Post by peanut-walrus »

yabones wrote: post #7

Oooooh that's really bad. Wordpress on Cpanel sites is like the Dark Matter of the internet, it's everywhere and you don't see it until something bad happens. Libations for the sysadmins patching & cleaning up this mess.

90% of those sites don't have anything resembling a sysadmin. If they've not already been hijacked by one of the Wordpress vulns or hijacked plugins years ago, they will be now. And absolutely nobody will spend any effort to fix them, so they will just end up chugging along until safebrowsing flags them and basically removes them from the internet.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#47

Post by christophilus »

amluto wrote: post #19

I like how the vulnerability is in the path that (a) attempts to write the password in reversibly encrypted form to disk [0] and (b) has a weird fallback path that writes it in clear text. Sigh. [0] cPabel seems to be from 1996. We’ve known this is a mistake since before 1996.

Yeah. There are a lot of people saying, “This is why you don’t roll your own…” but if I’d rolled my own, there wouldn’t have been reversible encryption involved, and there certainly wouldn’t have been plain text.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#48

Post by carlosjobim »

I really feel I have to shill for Fastpanel (www.fastpanel.direct) when it comes to graphical web server UIs.

A couple of years ago I got really sick and tired of cPanel, and started trying all these alternatives. I'm not an Arch Linux SSH freak, I need a GUI. And none of the panels had old school functions like setting up FTP and such.

So good luck to the Estonian (I think?) developers of Fastpanel and good riddance to that bloated slug cPanel.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#50

Post by caspper69 »

dijit wrote: post #32
caspper69 wrote: post #25

This flurry of activity is certainly going to have people be more apprehensive about unproven software that may be of dubious prominence. My question amid all of this is who else knew about these long-standing vulnerabilities?

cPanel is just about as far away from “unproven” as possible.

I think you misunderstood. My comment was meant to imply that people would be extra careful about all new software for a while. I know cpanel isn't unproven. It's been around forever.
Post reply on HN