tag: Cpanel · 8 items
- Engineer — Act: cPanel/WHM is widely deployed as a hosting control panel; authentication bypass with CISA KEV listing, EPSS 0.99, and a public PoC means exploitation is trivial and active. Patch cPanel/WHM immediately to the vendor-issued fixed version and audit access logs for any unauthorized sessions.
- SOC/IR — Act: Active exploitation of an internet-facing control panel auth bypass warrants an immediate assume-breach sweep on any cPanel/WHM instances in your estate. Hunt for anomalous authenticated sessions or privilege escalation activity since the PoC dropped, and tune detections for unauthenticated access patterns against port 2083/2087.
- Leader — Act: CISA KEV listing with EPSS 0.99 on a widely-used hosting panel is a board-question-level event — confirm whether your infrastructure or managed hosting vendors run cPanel/WHM and request written confirmation of patching status before end of week.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Plan: Root code execution reachable by any cPanel account holder is a severe privilege-escalation path, but no KEV listing, public PoC, or active-exploitation signals are present. Upgrade cPanel to the vendor-released fixed versions for both the CalDAV/CardDAV service and the WP Toolkit plugin before the quarter ends.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Acronis itself warns of in-the-wild exploitation of a Linux local privilege escalation in its backup plugin for cPanel, WHM, and Plesk — patch the Acronis backup plugin to the fixed version immediately on any hosting or panel infrastructure you operate.
- SOC/IR — Plan: Active exploitation is claimed but no IOCs or ATT&CK-mapped TTPs are published yet; build or tune detection for anomalous privilege escalation events on Linux hosts running cPanel/WHM/Plesk and revisit when indicators surface.
- Leader — Skip
- Engineer — Act: The plugin is confirmed exploited in targeted attacks despite no KEV listing; if you run cPanel/WHM with the Acronis Backup plugin on Linux, update to the patched version immediately and audit file permissions on affected hosts.
- SOC/IR — Plan: No IOCs are published yet, but active targeted exploitation warrants building a detection for abnormal privilege escalation events originating from Acronis backup processes on cPanel/WHM Linux hosts; queue a hunt for unusual UID-0 transitions tied to Acronis service accounts.
- Leader — Skip
- Signals: CVE-2026-87886 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Plan: Every supported cPanel and WHM version is affected; a mail-privileged hosting account can write arbitrary files and escalate to root via EmailTrack. Patch to the latest cPanel/WHM release (advisory published Sep 8) within your next patch window — no PoC or active exploitation is confirmed yet, but root-level impact makes this high priority.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC exists for a root-level RCE in cPanel and WHM affecting all supported versions — update cPanel/WHM to the patched release immediately and verify no unauthorized access occurred on any exposed panels.
- SOC/IR — Plan: With a public PoC now available, write or enable detections for anomalous root-process spawning from cPanel/WHM processes and unusual web requests to the cPanel/WHM management interfaces before exploitation campaigns begin.
- Leader — Skip
- Signals: CVE-2026-65643 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub paired with a CVSS 9.4 privilege-boundary break makes this urgent for any operator running cPanel. Apply the targeted security release immediately and verify no cross-account SQL activity in database logs since the release date.
- SOC/IR — Plan: No active exploitation is confirmed (EPSS 0.01), but the public PoC means detection coverage is worth building now. If cPanel is in your estate, develop a hunt for anomalous database queries originating from hosting-account contexts executing with root-level DB identity.
- Leader — Skip
- Signals: CVE-2026-58048 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: cPanel/WHM is widely deployed by hosting providers and MSPs; CISA KEV listing plus EPSS 0.98 and public PoC confirm active exploitation risk. Patch to the vendor-released fixed version immediately and audit for signs of unauthorized access in cPanel/WHM logs.
- SOC/IR — Act: With a public PoC and KEV listing, opportunistic exploitation is underway — sweep for anomalous cPanel/WHM authentication events and unexpected admin account creation since the PoC publication date, and tune detections for unauthenticated access patterns on WHM ports.
- Leader — Plan: If your organization or any managed-hosting vendor uses cPanel/WHM, confirm patching status and request attestation this week; the KEV listing signals broad exploitation, but direct board escalation is warranted only if you host customer data on affected systems.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub