[dead]
CPanel and WHM Authentication Bypass – CVE-2026-41940
51–60 of 64 posts
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#52Earlier quoted context omitted.
Yeah, I hate all those terrible regulations that keep people from burning alive in their homes too. Godddamn goverment saving lives, it's so slightly annoying. Wait. Wasn't there a whole group of people who thought this way recently? Wasn't it called the Department of Government Efficiency? Wasn't it led by a rich tech bro who wants to live on Mars? Didn't they get disbanded because it was a bunch of armchair experts…
What regulations would you suggest would be the software equivalent of a fire code? What kind of penalties would apply for not meeting these regulations? Who would be responsible for enforcement? Do you propose this should apply internationally? Or just to software written in a specific region? Or is the location of where software is hosted (or the headquarters of the company operating the hardware) a better target f…
You're right, there's absolutely no balance you could strike!
Hmm, I wonder how the FDA approves software in a medical devices context. Or if the EU AI act is in any way a precedent.
Oh well, we'll never know.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#53Yeesh, first kernel root exploit, now this...
Low key wonder if people using LLMs to scan these old code bases for corner case issues and fining treasure troves of exploits.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#54Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…
I tend to agree and I often strongly recommend to my clients to choose battle tested off-the-shelf solutions for these problems rather than roll their own, but...
Sometimes it makes sense to roll your own and the cost of a dependency isn't worth it. This can be especially true when you need to accommodate many bespoke environments and you end up needing to make little accomodations here and there. Can create a very unpleasant situation when you don't own the code.
I'm not a cryptographer but I've spent a significant portion of my career focusing on the security-side of things and I've rolled my own auth quite a few times on very public projects you can access today and I've never had any significant findings through repeated pentests.
But that's just the thing: I did it the right way, and there is a right way to roll your own stuff, to forge it in a way it comes out suitable. Is it bug free? Probably not, but I feel significantly better about it having thoroughly tested it by myself, my colleagues and paid professional penetration testers.
I couldn't easily find an answer but I'd like to know if this implementation has been validated by a professional or not.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#55FWIW, a sharp and immediate uptick in support tickets from self-identified WHM resellers and admins who need backups from their rsync.net accounts right now.
I would think that for everyone that needs some help, there must be 10 who self served…
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#56Y'know what would help protect those internet buildings from falling on people? A software building code
No.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#57Anyone who has ever seen cPanel's software engineering abilities (ie any of the source) should not be surprised by this
They should have switched to a web framework long ago
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#58What a shame that I no longer have access to my teenage-level conscience, I am sallivating at the idea of going wild with this and the Copy Fail cve. The potential here to do all kinds of manipulation for search engines / AI tools is enormous. Perhaps the more scary thought is that someone could easily make an agent that would exploit both bugs to wipe out servers. Good on these companies to publish their findings st…
You don’t need CopyFail on these systems if you have this one. This gives you root access to the system through the web interface.
Re: CPanel and WHM Authentication Bypass – CVE-2026-41940
#59cPanel being the backbone of the internet's cheap hosting layer was already a monoculture risk waiting to bite us - turns out we didn't have to wait long
If you want to talk monoculture… cPanel and Plesk are both owned by WebPros the past several years. There’s your #1 and #2 in the space.