Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

copahost.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#61

Post by diek »

ipaddr wrote: post #55
diek wrote: post #52

Earlier quoted context omitted.

CVE-2021-21703 [0] is a similar class of bug in the PHP interpreter itself that was pretty recent https://www.sentinelone.com/vulnerability-database/cve-2021-...

This is not a PHP language interpreter bug this is a PHP FPM bug.

That's a fair point, using 'interpreter' specifically was imprecise language on my part. My main point was php-fpm is developed by the core PHP team and is often the default in how PHP projects deploy these days, and that CVE was very similar to the recent 'fail' LPE vulnerabilities in the kernel.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#62

Post by duskwuff »

ilia-a wrote: post #14
kiritanpo wrote: post #3

Earlier quoted context omitted.

Most shared hosting plans use cpanel. It's still widely used yes for a lot of smaller websites.

I wonder how much shared hosting is there really left, I imagine much of it move to VPS or cheap cloud boxes.

I'm especially curious how much small-scale shared hosting is left. The big companies like EIG are certainly still around, but the little one-off hosting companies are much less common.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#63

Post by jmb99 »

rstupek wrote: post #51
dylan604 wrote: post #38

Earlier quoted context omitted.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

If you get a letsencrypt certificate it will get probed within a minute

I’ve tested this recently (this post week). Had a dns entry up and pointing to an nginx server for ~12 hours, zero requests. 17 seconds after the letsencrypt cert was issued, the floodgates opened. Over a dozen of requests per second.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#65

Post by walrus01 »

jmb99 wrote: post #63
rstupek wrote: post #51

Earlier quoted context omitted.

If you get a letsencrypt certificate it will get probed within a minute

I’ve tested this recently (this post week). Had a dns entry up and pointing to an nginx server for ~12 hours, zero requests. 17 seconds after the letsencrypt cert was issued, the floodgates opened. Over a dozen of requests per second.

I don't think it's necessarily specific to LE but rather to public certificate transparency logs. LE being free and easy to automate means it's very widely used these days, but if you theoretically go to a "pay" root CA and get a cert that covers thing.com and www.thing.com , the same probing will happen on the same time scale.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#66

Post by nubinetwork »

hamburglar wrote: post #41
dylan604 wrote: post #38

Earlier quoted context omitted.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

Dismissing these as script kiddie attempts is no longer correct. This is a real industry now. It’s not like the large scale actors are going to pass up a valid unpatched vector just because it’s old hat.

They're skiddies if they're trying WordPress attacks on domains that have never hosted anything remotely close to a CMS before...

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#67

Post by himata4113 »

zb3 wrote: post #40

"AI safeguards" are not working I guess.. or maybe they're only working against those who'd like to secure their software.. good job Anthropic + OpenAI!

The AI safeguards are indeed a joke, you can get around their classifier by simply masking out all the unsafe words and it will happily work on your rootkit.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#68

Post by nullsanity »

majicDave wrote: post #37
TZubiri wrote: post #12

Earlier quoted context omitted.

[flagged]

> The concept of a GUI wrapper on top of the Linux ecosystem is what's broken That is a nugget, it's so true. Wrappers in general are such an issue in software. Wrappers built on top of wrappers, this desire to abstract everything away makes things look simpler, but every layer slows things down and hides what is actually happening. Every wrapper is another layer of complexity, another hoop to jump through when you'r…

[dead]

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#69

Post by echelon »

> CPanel

Now there's a name I haven't heard since the 2005 or so era.

How is that thing still around?

Next you're going to tell me people still run phpBB and vBulletin somewhere. And use FileZilla FTP. And manage their database with phpMyAdmin.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#70

Post by vachina »

echelon wrote: post #69

> CPanel Now there's a name I haven't heard since the 2005 or so era. How is that thing still around? Next you're going to tell me people still run phpBB and vBulletin somewhere. And use FileZilla FTP. And manage their database with phpMyAdmin.

Nothing wrong with those stacks. They’re akin to assembly language for the backend. Nitty gritty but super close to the metal.
Post reply on HN