Tag: web hosting
9 articles
cPanel Flaw Enables Root Code Execution via Domain Functionality
A critical cPanel security flaw, tracked as CVE-2026-65643, allows attackers to execute code as the root user, giving them full control of the server, by exploiting domain parking and addon domain functionality. This vulnerability impacts all supported versions of cPanel & WHM and can be triggered by an authenticated account holder.
Hackers Exploit npm Mirrors to Host Phishing Pages
Hackers are exploiting npm mirrors to host phishing pages by uploading malicious HTML files to the npm registry, which are then mirrored and can be accessed directly in a browser. This clever tactic turns the trusted registry into a free web host for malware, allowing threat actors to spread phishing pages under the guise of legitimate content.
cPanel Flaw Exposes Database Vulnerability to Authenticated Users
A critical cPanel flaw, CVE-2026-58048, with a near-perfect CVSS score of 9.4, allows authenticated users to execute SQL commands with root-level access, putting databases at risk. This vulnerability lets users with basic cPanel access escalate privileges and take control of the server's administrative database.
GitHub Actions Abused to Target cPanel, WHM Servers
Malicious actors have cleverly exploited GitHub Actions to launch attacks on cPanel and WHM servers, using compromised source repositories to unleash a wave of automated exploits. By adding dozens of malicious workflows, attackers can scan and exploit vulnerable systems with alarming ease.
cPanel flaw fuels mass Sorry ransomware attacks
A critical flaw in cPanel, tracked as CVE-2026-41940, has been exploited in a massive ransomware campaign, compromising at least 44,000 IP addresses. This alarming attack has already been used in the wild as a zero-day, with threat actors accessing control panels and wreaking havoc on web hosting systems.
cPanel Bug Exploited in Wild as Zero-Day Before Patch Release
A cPanel bug, tracked as CVE-2026-41940, was exploited in the wild as a zero-day vulnerability before a patch was released, with attackers making execution attempts as early as February 23, 2026. The flaw forced vendors and hosting providers into emergency mitigation, with cPanel finally releasing a fix on April 28, 2026.
cPanel Rushes Emergency Update to Fix Auth Bypass Bug
A critical security vulnerability in cPanel software has been discovered, allowing unauthorized access to the control panel, prompting immediate action from providers like Namecheap to protect customers. cPanel has since rushed out an emergency update to fix the authentication bypass bug affecting all currently supported versions.
cPanel Discloses Authentication Flaw, Urges Immediate Server Updates
cPanel has uncovered a critical authentication flaw that could let hackers gain unauthorized access to your control panel, and is urging immediate server updates to protect against this threat. Check if your version is vulnerable and update to a patched build right away.
GoDaddy Domain Transfer Exposes Non-Profit to Security Risks
A shocking security breach occurred when a 27-year-old domain was transferred from a GoDaddy account to another customer without any authentication checks, putting a non-profit at risk. The alarming transfer was completed in just four minutes, raising serious concerns about GoDaddy's domain transfer process.