Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPanel and WHM Authentication Bypass – CVE-2026-41940

labs.watchtowr.com

Post reply on HN
Print view View original

61–64 of 64 posts

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#61

Post by cestith »

londons_explore wrote: post #29
superasn wrote: post #5

Everytime I read one of these it always boils down to the same thing..Don't solve solved problems. And the best code in this case is code you didn't write as PHP's session handler is battle-tested but every line you write to roll your own is a line you have to secure, maintain, and eventually patch at 2am when someone finds the bug. Session handling, auth, crypto, password hashing etc - all these are the exact areas…

I doubt the mantra of "don't roll your own Auth/crypto" - especially if it lives on a server where the code can't be inspected. Sure, there will be more bugs in my code, but the attackers will be putting far more scrutiny into a widely used library. Some deliberately hilariously weak auth I built decades ago is only just now starting to get broken into by AI bots, whereas any vulnerable wordpress was broken into with…

There are well over a million cPanel/WHM installations in the world.

Re: CPanel and WHM Authentication Bypass – CVE-2026-41940

#62

Post by rcxdude »

bux93 wrote: post #52
jamesknelson wrote: post #40

Earlier quoted context omitted.

What regulations would you suggest would be the software equivalent of a fire code? What kind of penalties would apply for not meeting these regulations? Who would be responsible for enforcement? Do you propose this should apply internationally? Or just to software written in a specific region? Or is the location of where software is hosted (or the headquarters of the company operating the hardware) a better target f…

You're right, there's absolutely no balance you could strike! Hmm, I wonder how the FDA approves software in a medical devices context. Or if the EU AI act is in any way a precedent. Oh well, we'll never know.

You don't want to see how the sausage is made for medical software. The average quality I would put at below your median SaaS webapp. Security especially is not something you should expect.
Post reply on HN