CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

eagerpace•4 minutes ago

Wow, similar sentiments about this being a throw back. I’d rather roll my own almost everything these days, may not be as good, but certainly won’t be targeted exploited broadly.

zuzululu•about 2 hours ago

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously

Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

dainiusse•about 2 hours ago

I don't agree that "old" necessarily implies vulnerability.

pixl97•about 1 hour ago

I mostly disagree on your disagreement unless the entire project was based on top security practices and good code in the first place. The vast majority of these web panels are a security nightmare.

omnimus•about 1 hour ago

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web.

They cannot be that bad if they are managing to be ductape of the internet.

TZubiri•about 2 hours ago

The concept of a GUI wrapper on top of the Linux ecosystem is what's broken.

Not because of a fundamental limitation of that architecture, but because in practice the type of people that will use it do not want to learn or develop the necessary skills to administer it, and critical information like man pages and parameter lists are hidden.

You can't take shortcuts without consequences.

ricardonunez•42 minutes ago

Of course is the architecture and the creator of such a thing, isn’t the point of a tool like that for users that don’t have the tech knowledge? I have only used those systems on shared hosting, host providers are the one maintaining and should be keeping them up to date and WHM/Cpnel have plenty of customers to worry too patch holes, if they can’t then who’s fault is it, Architecture, or provider? Hope is the customers fault?

anonzzzies•about 2 hours ago

CPanel and hosters who use them are in big trouble now; there are millions of servers running them, many of them for decades. Their clients can run code as an user without much sandboxing/guardrails at all.

breakingcups•about 2 hours ago

Such a different era.

omnimus•about 1 hour ago

If you look at the usage numbers, you could argue we are still in that era.

addedGone•about 1 hour ago

I miss this era, we overcomplicated everything

operatingthetan•about 2 hours ago

People are still using cpanel?

kiritanpo•about 2 hours ago

Most shared hosting plans use cpanel. It's still widely used yes for a lot of smaller websites.

dawnerd•about 1 hour ago

And even if it doesn’t look like it chances are it still is with a fancier ui on top.

ilia-a•about 1 hour ago

I wonder how much shared hosting is there really left, I imagine much of it move to VPS or cheap cloud boxes.

omnimus•about 1 hour ago

I highly doubt that. It's giant market and with these custom small sites made by third parties you actually want to have client owned hosting and third parties who deploy to that hosting. Clients have learned to separate these otherwise the third party can have huge leverage (your business and all data is ours).

xp84•about 2 hours ago

There are a lot of things that have been up for decades. The ROI on moving a simple PHP or static website to new hosting situation hasn’t been that compelling… though that could change. Thing is, I suspect most users of shared hosting which is Cpanel’s bread and butter are not reading the latest cybersecurity news.

TZubiri•about 1 hour ago

The ROI has just increased by like 10x or 100x this week.

ramesh31•about 2 hours ago

CPanel on shared hosting running WordPress PHP is literally half of the entire internet still.

walrus01•13 minutes ago

And if it's not cpanel, it's Plesk

whatsupdog•about 2 hours ago

Half of the entire internet is Meta properties.

fmbb•about 2 hours ago

That’s the other half.

Coincidentally also PHP.

CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

⚡ Community Insights

Discussion (29 Comments)Read Original on HackerNews