Tag: security

CVE-2026-41940, the cPanel authentication bypass exploited for 64 days before disclosure, is still developing. 44,000 servers likely compromised, a public exploit on GitHub, three active campaigns. This page is updated in real time as new information surfaces.

CVE-2026-41940, the cPanel authentication bypass from April 28, was being exploited since February 23, operated as a zero-day for 64 days, and was added to CISA's Known Exploited Vulnerabilities list with 1.5 million internet-exposed instances counted by Rapid7.

Copy Fail (CVE-2026-31431) is a Linux kernel privilege escalation giving any unprivileged local user root access, affecting virtually all distributions since 2017, with shared hosting and multi-tenant environments at highest risk.

cPanel disclosed a critical authentication bypass on April 28 affecting nearly all versions of cPanel and WHM, with active exploits confirmed in the wild before the patch was released, forcing hosting.com, Namecheap, KnownHost, HostPapa, and InMotion Hosting to take cPanel access offline globally.

OpenClaw has 138 documented security advisories and a market fractured into four tiers, ranging from $3.85 managed VPS to NVIDIA's NemoClaw enterprise stack and Cloudflare's ephemeral-container proof-of-concept.

Flippa celebrated the six-figure sale of the Essential Plugin portfolio; eight months later the buyer activated a backdoor across 20,000+ WordPress sites using Googlebot cloaking and a C2 routed through an Ethereum smart contract.

When a client's website gets compromised, the hosting provider's response in the next few hours determines whether that client is still a customer next month.

Let's Encrypt replaces its root certificate hierarchy on May 13, closes client authentication support permanently on July 8, and hosting operators have less than four weeks to verify their renewal automation handles the transition.

The 3-2-1 backup rule was designed for hardware failure and accidental deletion, not for an attacker who has your credentials and can authenticate to your backup console before triggering ransomware.

The European Commission confirmed attackers accessed its AWS-hosted Europa.eu infrastructure and took data. AWS says its platform was not the issue, the customer account configuration was.