Loading story…
CVE-2023-29489 is a reflected, pre-authentication cross-site scripting flaw in cPanel’s default web-hosting control-panel configuration. Crafted requests to the /cpanelwebcall/ path could execute arbitrary JavaScript in a victim’s browser because Apache proxies that directory to cPanel management ports, including when the request reaches the server through ports 80 or 443.
An attacker could use the flaw to steal or hijack an authenticated cPanel session and, through the victim’s privileges, upload a web shell for potential command execution on the hosted server. cPanel fixed the issue in versions 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31; affected administrators should ensure their deployments are updated to a remediated release.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
cPanel released fixes for the pre-authentication XSS flaw and publicly disclosed it. Fixed releases included 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
cPanel confirmed the reported reflected XSS vulnerability and assigned it the internal identifier SEC-669.
Shubham Shah of Assetnote disclosed a pre-authentication reflected XSS vulnerability in cPanel to cPanel, which acknowledged receipt of the report the same day.
A technical analysis described exploitation through cPanel's /cpanelwebcall/ error handling, where attacker-controlled invalid webcall IDs reached an unsanitized message_html value. It also found Apache proxy rules could expose the flaw through ports 80 and 443, enabling authenticated-session hijacking and possible web-shell upload; the fix HTML-encodes message_html.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourceblog.assetnote.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026
cPanel disclosed and patched a critical authentication bypass in cPanel & WHM, tracked as **`CVE-2026-41940`**, after reports of active in-the-wild exploitation against hosting infrastructure. The flaw affects authentication paths in supported versions and can let unauthenticated attackers reach administrative interfaces, forge authenticated sessions, and potentially gain control of hosted websites, databases, email accounts, and server configuration. Government and industry alerts warned that shared hosting environments face outsized risk because a single compromised server can expose many downstream customer sites, and some providers temporarily restricted cPanel and WHM login ports while applying fixes. Public technical analysis and a GitHub proof-of-concept described an exploit chain involving manipulated HTTP headers and session cookie handling to create forged privileged sessions, including possible root-level WHM access. Separately, cPanel also patched three additional vulnerabilities in cPanel & WHM and **WP Squared**—**`CVE-2026-29201`**, **`CVE-2026-29202`**, and **`CVE-2026-29203`**—that enable arbitrary file read through path traversal, Perl code injection leading to remote code execution, and denial-of-service via unsafe symlink handling. The most severe of the newly disclosed flaws, **`CVE-2026-29202`**, affects the `create_user` API and can allow arbitrary Perl code execution on the server, reinforcing calls for immediate upgrades, restricted access to management interfaces, and log review for suspicious authorization and cookie activity.
Jun 29, 2026
cPanel has patched **CVE-2026-65643**, a critical flaw in cPanel & WebHost Manager (WHM) domain-parking and addon-domain functionality. A low-privileged authenticated hosting account authorized to add parked or addon domains can create arbitrary files on the underlying server, potentially leading to code execution as `root` and full control of the host. The issue affects all supported cPanel & WHM release branches, with fixes issued for 11.110, 11.134, 11.136, and 11.138, including WP Squared. Shared and reseller-hosting operators should apply the relevant patched build immediately; systems on end-of-life branches must be upgraded to a supported release, and unpatched deployments should restrict parked- and addon-domain permissions. cPanel had not disclosed a CVSS score, detection guidance, interim mitigation, or confirmed in-the-wild exploitation.
Sep 1, 2026