CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

Post by hamburglar » Sat, May 09, 2026, 9:05 PM UTC

dylan604 wrote: post #38

omnimus wrote: post #16

Earlier quoted context omitted.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

Post by ggallas » Sat, May 09, 2026, 9:12 PM UTC

Meekro wrote: post #27

omnimus wrote: post #16

Earlier quoted context omitted.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked. On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.

Post by dylan604 » Sat, May 09, 2026, 9:20 PM UTC

hamburglar wrote: post #41

dylan604 wrote: post #38

Earlier quoted context omitted.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

Dismissing these as script kiddie attempts is no longer correct. This is a real industry now. It’s not like the large scale actors are going to pass up a valid unpatched vector just because it’s old hat.

Post by ggallas » Sat, May 09, 2026, 9:33 PM UTC

anonzzzies wrote: post #5

CPanel and hosters who use them are in big trouble now; there are millions of servers running them, many of them for decades. Their clients can run code as an user without much sandboxing/guardrails at all.

Post by josu » Sat, May 09, 2026, 9:57 PM UTC