Most LAMP FOSS web apps have a long history of being hacked.
Is there any specific LAMP web app(s) that has a very good history of not being hacked?
I can't think of any readily but I imagine someone here knows one or two.
CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
71–80 of 83 posts
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#72> CPanel Now there's a name I haven't heard since the 2005 or so era. How is that thing still around? Next you're going to tell me people still run phpBB and vBulletin somewhere. And use FileZilla FTP. And manage their database with phpMyAdmin.
Nothing wrong with those stacks. They’re akin to assembly language for the backend. Nitty gritty but super close to the metal.
PHP (apart from the Hack offshoot) isn't a compiled language, so it's nowhere "close" to anything.
LAMP apps are frequently mentioned in RCE CVEs.
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#73Most LAMP FOSS web apps have a long history of being hacked. Is there any specific LAMP web app(s) that has a very good history of not being hacked? I can't think of any readily but I imagine someone here knows one or two.
Mediawiki seems pretty solid on that front in my 10+ years of running and using it
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#74Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain
Cpanel is Perl, not PHP. Probably the grayest of the gray beards. Perhaps not enough Perl Wizards left to maintain it nowadays.
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#75Not all webhosting companies are using cpanel. Cpanel increased their prices exponentially in the last few years.
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#76> CPanel Now there's a name I haven't heard since the 2005 or so era. How is that thing still around? Next you're going to tell me people still run phpBB and vBulletin somewhere. And use FileZilla FTP. And manage their database with phpMyAdmin.
Why, is there a better alternative to the PHP-based forums? (I tried Discourse and it sucks.)
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#77Earlier quoted context omitted.
Of course is the architecture and the creator of such a thing, isn’t the point of a tool like that for users that don’t have the tech knowledge? I have only used those systems on shared hosting, host providers are the one maintaining and should be keeping them up to date and WHM/Cpnel have plenty of customers to worry too patch holes, if they can’t then who’s fault is it, Architecture, or provider? Hope is the custom…
I would worry less about big shared hosting providers, who have a strong interest in patching their stuff quickly, than the market of people who get one or two dedicated servers or KVM VMs and then install cpanel on them and for the rest of the time they use it, ignore the CLI of the servers and never patch anything. There's a lot of small users of cpanel that have just a few licenses.
You misunderstood the scope and severity of the bug entirely.
Yes, if you are a single tenant, this diminishes defense in depth, so an attacker that gets access with a user like www-data can escalate to root, sure.
But more importantly, on multi-tenant systems, one tenant can get root and pwn all the other tenants.
Big shared hosting providers are the most vulnerable, 'just patching' stuff might work sure, but there's several scenarios where it might not be enough, like lightning striking twice as it just happened. Or an attacker getting in before the patch.
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#78Earlier quoted context omitted.
Dismissing these as script kiddie attempts is no longer correct. This is a real industry now. It’s not like the large scale actors are going to pass up a valid unpatched vector just because it’s old hat.
They're skiddies if they're trying WordPress attacks on domains that have never hosted anything remotely close to a CMS before...
Imagine this; ~40% of public websites run wordpress. (based on some AI-gen summary, even if fewer it is still an important percentage).
So you might be spinning up a new instance with 40% probability. It makes sense in mass vulnerability explotation and detection to aim for highest success rate first.
Especially when the IPv4 space is so easy to scan nowadays. And you have services like Shodan that do just that daily.
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#79We've been running Centminmod on our servers for years. Love the software. There is no fancy web UI but it does have CLI menus, etc... so, definitely not for the novice but it's really good at what it does. I'm not affiliated, just a happy customer:
Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
#80Earlier quoted context omitted.
I would worry less about big shared hosting providers, who have a strong interest in patching their stuff quickly, than the market of people who get one or two dedicated servers or KVM VMs and then install cpanel on them and for the rest of the time they use it, ignore the CLI of the servers and never patch anything. There's a lot of small users of cpanel that have just a few licenses.
You misunderstood the scope and severity of the bug entirely. Yes, if you are a single tenant, this diminishes defense in depth, so an attacker that gets access with a user like www-data can escalate to root, sure. But more importantly, on multi-tenant systems, one tenant can get root and pwn all the other tenants. Big shared hosting providers are the most vulnerable, 'just patching' stuff might work sure, but there'…
I understand the concept of a local privilege escalation just fine, thanks. My point was that large hosting providers are much more likely to have people paying attention to patching these things (and possibly, worst case scenario as you describe, mitigating things if someone does compromise a shared hosting system). Individual one-off cpanel instances may have nobody paying attention to security issues for months or years at a time until something totally breaks.