Resolved cPanel Zero Day Exploit - Network wide protections in place for cPanel and WHM logins/ports

KH-JonathanKW

KH-JonathanKW

Billing & Sales Manager
Staff member
IMPORTANT – Please read immediately

cPanel announced that a zero-day authentication/privilege escalation bug that affects almost all known (both EoL and supported) cPanel versions was discovered a short while ago and successful exploits have been seen in the wild.

At this time, a limited scope of information is available about the bug and the cPanel team is actively working on a patch. Cpanel’s official article can be found at https://support.cpanel.net/hc/en-us...rability-with-cPanel-WHM-Login-Authentication

Due to the potential nature of this issue and out of an abundance of caution, we’ve begun blocking WHM/cPanel login ports across the KnownHost network (including ports 2082, 2083, 2086, and 2087). The blocks cannot be removed/modified per server/customer and will be removed once suitable patches have been released or cPanel has more information available.

We realize that this type of immediate change affects customer access, but want to ensure that all servers remain safe while cPanel investigates further as necessary.
 
UPDATE

This exploit has been expanded to cover cPanel webmail ports 2095/2096.

These are now currently blocked at the network level.

EDIT: This includes webdisk ports 2077 and 2078
 
Last edited:
UPDATE:
Our team continues to work directly with cPanel on the release of a security patch. As soon as one is available, we will begin updating servers. Network blocks for cPanel, WHM, Webmail, and Webdisk ports remain in place at this time.

Thank you for your continued patience.
 
UPDATE:

Patches have been released by cPanel to address the issue. We are in the process of rolling out these updates to all managed customers. If you are an unmanaged customer running cPanel then you'll want to SSH into your system and execute /scripts/upcp to pull the latest version.

We anticipate this process is going to take much of the afternoon and into the night as thousands of machines need to receive the patches before we can open the network up.

We will continue to post regular updates as we have them.
 
UPDATE:
Staff continue to make their way through the network, applying the security patch. Thank you again for your extended patience
 
UPDATE:

We have pushed out patches to the majority of our network to mitigate the exploit. As such we've restored access to the cPanel ports that were previously blocked.

Our team will continue to work to mitigate any edge case systems remaining on our network. We do appreciate everyone's patience and understanding.
 
You must log in or register to reply here.
Top