CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

There are a lot of things that have been up for decades. The ROI on moving a simple PHP or static website to new hosting situation hasn’t been that compelling… though that could change. Thing is, I suspect most users of shared hosting which is Cpanel’s bread and butter are not reading the latest cybersecurity news.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#5

Post by anonzzzies » Sat, May 09, 2026, 5:55 PM UTC

CPanel and hosters who use them are in big trouble now; there are millions of servers running them, many of them for decades. Their clients can run code as an user without much sandboxing/guardrails at all.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#6

Post by ramesh31 » Sat, May 09, 2026, 5:57 PM UTC

operatingthetan wrote: post #2

People are still using cpanel?

CPanel on shared hosting running WordPress PHP is literally half of the entire internet still.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#7

Post by zuzululu » Sat, May 09, 2026, 5:57 PM UTC

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously

Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#8

Post by whatsupdog » Sat, May 09, 2026, 6:00 PM UTC

ramesh31 wrote: post #6

operatingthetan wrote: post #2

People are still using cpanel?

CPanel on shared hosting running WordPress PHP is literally half of the entire internet still.

Half of the entire internet is Meta properties.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#9

Post by dainiusse » Sat, May 09, 2026, 6:05 PM UTC

zuzululu wrote: post #7

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

I don't agree that "old" necessarily implies vulnerability.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#10

Post by fmbb » Sat, May 09, 2026, 6:07 PM UTC

whatsupdog wrote: post #8

ramesh31 wrote: post #6

Earlier quoted context omitted.

CPanel on shared hosting running WordPress PHP is literally half of the entire internet still.

Half of the entire internet is Meta properties.

That’s the other half.

Coincidentally also PHP.