cPanel Authentication Bypass Exploitation Active | MSSP Advisory

Multiple proof-of-concept exploits have emerged targeting a critical authentication bypass vulnerability in cPanel, with claims of zero-day exploitation occurring for at least a month before public disclosure. The vulnerability allows attackers to bypass authentication mechanisms in cPanel installations. One researcher indicates active exploitation preceded the public vulnerability disclosure.

Your hosting clients running cPanel are sitting ducks right now, and if you manage any cPanel instances for web hosting clients, your access credentials could hand attackers the keys to multiple client environments simultaneously. The month-long exploitation window before disclosure means compromised systems are already out there, and your clients expect you to know about threats hitting their hosting infrastructure before they read about it on Twitter.