27 ms·
CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
- operatingthetan 5mo agoPeople are still using cpanel?
- ramesh31 5mo agoCPanel on shared hosting running WordPress PHP is literally half of the entire internet still.
- whatsupdog 5mo agoHalf of the entire internet is Meta properties.
- fmbb 5mo agoThat’s the other half. Coincidentally also PHP.
- Shish2k 5mo agoFacebook started out PHP; but they ship-of-theseus'ed it into Hack by replacing the standard library, the language, and the runtime engine, so now it's a totally different thing with only a few superficial similarities (FWIW IMO Hack is much better than PHP, I'm sad that it never gained traction...)
- ceejayoz 5mo agoMuch of what was good in Hack just got rolled into PHP.
- walrus01 5mo agoAnd if it's not cpanel, it's Plesk
- kiritanpo 5mo agoMost shared hosting plans use cpanel. It's still widely used yes for a lot of smaller websites.
- ilia-a 5mo agoI wonder how much shared hosting is there really left, I imagine much of it move to VPS or cheap cloud boxes.
- omnimus 5mo agoI highly doubt that. It's giant market and with these custom small sites made by third parties you actually want to have client owned hosting and third parties who deploy to that hosting. Clients have learned to separate these otherwise the third party can have huge leverage (your business and all data is ours).
- walrus01 5mo agoThere's still a very big market of people for whom being given a VPS with ssh access and a command line is beyond their technical capability or comfort level. Ever seen the upsell offers in the check-out workflow for hosting packages that come when you buy a new .com domain from any major registrar? All those are shared hosting packages where everything is done through some sort of web gui.
- smallerize 5mo agoBut you have to keep a VPS updated yourself, right? A hosted site doesn't require any action from the customer to stay up to date.
- duskwuff 5mo agoI'm especially curious how much small-scale shared hosting is left. The big companies like EIG are certainly still around, but the little one-off hosting companies are much less common.
- dawnerd 5mo agoAnd even if it doesn’t look like it chances are it still is with a fancier ui on top.
- xp84 5mo agoThere are a lot of things that have been up for decades. The ROI on moving a simple PHP or static website to new hosting situation hasn’t been that compelling… though that could change. Thing is, I suspect most users of shared hosting which is Cpanel’s bread and butter are not reading the latest cybersecurity news.
- TZubiri 5mo agoThe ROI has just increased by like 10x or 100x this week.
- throwawaytea 5mo agoI run an entire saas that 36 companies pay for, built in PHP, and I drag and drop the files to the server via cpanel.
- anonzzzies 5mo agoCPanel and hosters who use them are in big trouble now; there are millions of servers running them, many of them for decades. Their clients can run code as an user without much sandboxing/guardrails at all.
- breakingcups 5mo agoSuch a different era.
- rurban 5mo agoBut those are updated automatically. It's unlike Windows or Linux, where the user decides when to update. cPanel updates are decided by cPanel
- ggallas 5mo ago[dead]
- zuzululu 5mo agoAges ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain
- bouncycastle 5mo agoCpanel is Perl, not PHP. Probably the grayest of the gray beards. Perhaps not enough Perl Wizards left to maintain it nowadays.
- dminvs 5mo agowell, any accounts running outdated workloads (could be anything LAMP-flavored) could be attack vectors, with the entire shared machine possibly compromised by any weak account due to these latest LPEs these cPanel machines frequently run 4- or low-5-figure quantities of customer accounts, each with potentially multiple domains or CMS deployments, and not always the most technically-engaged customer base, so that's a lot of surface area to account for: how diligent can hosts realistically be about every WordPress plugin, every Drupal or Magento module, and so on? (nb I don't like shared hosting and am not defending it, just addressing the reality of the long tail)
- dainiusse 5mo agoI don't agree that "old" necessarily implies vulnerability.
- pixl97 5mo agoI mostly disagree on your disagreement unless the entire project was based on top security practices and good code in the first place. The vast majority of these web panels are a security nightmare.
- omnimus 5mo agoThese PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.
- eagerpace 5mo agoWow, similar sentiments about this being a throw back. I’d rather roll my own almost everything these days, may not be as good, but certainly won’t be targeted exploited broadly.
- hackthemack 5mo agoMany years ago. Maybe 2005 to 2015? I had a friend who used cpanel to run a web hosting company. He made quite a bit of money doing that. He was not a programmer, but he could setup up wordpress and install plugins. I remember asking him once if he was worried he would get hacked and then lose control of his servers? Lose his customers? He said he was worried but he had backups upon backups. I saw him restore a bunch of websites once, using cpanel, and I thought it is an amazing little bit of software with all of the click a button to setup many different things (like WAF). A real time saver and provides some guidance if you are not a unix-internet guru.
- rickdg 5mo agoFriendly reminder that there aren't that many ways for a normie to create their own (sub)domain with TLS and an email in under five minutes. That's cPanel for ya.
- walrus01 5mo agoThe alternatives to cpanel would mostly be all-in-one hosting providers like 'squarespace' or similar, which have rolled their own web GUI to automate a basic normie workflow of domain registration, putting basic DNS records in a zone, hosting the DNS, getting TLS certs, putting basic content on a httpd. It's interesting to see the "set up your small business website now!" advertising to totally non technical people.
- sgammon 5mo agoYes, there are many ways to do that now, in under 5 minutes. Cloudflare will set all of that up just fine. GSuite is much easier to set up than CPanel.
- zb3 5mo ago"AI safeguards" are not working I guess.. or maybe they're only working against those who'd like to secure their software.. good job Anthropic + OpenAI!
- himata4113 5mo agoThe AI safeguards are indeed a joke, you can get around their classifier by simply masking out all the unsafe words and it will happily work on your rootkit.
- josu 5mo agoSo CPanel's security is just as bad as their UI, who would have thought?
- lofaszvanitt 5mo agoYeah, it always was a dumpster fire.
- 0xbadcafebee 5mo ago44,000 servers compromised? Sounds like somebody could've used a software building code
- echelon 5mo ago> CPanel Now there's a name I haven't heard since the 2005 or so era. How is that thing still around? Next you're going to tell me people still run phpBB and vBulletin somewhere. And use FileZilla FTP. And manage their database with phpMyAdmin.
- vachina 5mo agoNothing wrong with those stacks. They’re akin to assembly language for the backend. Nitty gritty but super close to the metal.
- burnt-resistor 5mo agoPHP (apart from the Hack offshoot) isn't a compiled language, so it's nowhere "close" to anything. LAMP apps are frequently mentioned in RCE CVEs.
- whyoh 5mo agoWhy, is there a better alternative to the PHP-based forums? (I tried Discourse and it sucks.)
- burnt-resistor 5mo agoMost LAMP FOSS web apps have a long history of being hacked. Is there any specific LAMP web app(s) that has a very good history of not being hacked? I can't think of any readily but I imagine someone here knows one or two.
- iamacyborg 5mo agoMediawiki seems pretty solid on that front in my 10+ years of running and using it
- sourcecodeplz 5mo agoNot all webhosting companies are using cpanel. Cpanel increased their prices exponentially in the last few years.
- johng 5mo agoWe've been running Centminmod on our servers for years. Love the software. There is no fancy web UI but it does have CLI menus, etc... so, definitely not for the novice but it's really good at what it does. I'm not affiliated, just a happy customer: https://centminmod.com/ https://centminmod.com/
- hcaz 5mo agoI love Centminmod but some of our clients need a UI so we settled on a mix of https://hestiacp.com/ https://hestiacp.com/ and https://www.cloudpanel.io/ https://www.cloudpanel.io/