Month: May 2026

On April 28, 2026, cPanel disclosed CVE-2026-41940, an authentication bypass affecting nearly every supported version of cPanel and WHM, including a substantial backport range covering older releases. The bug let an unauthenticated remote attacker forge a fully privileged WHM session by exploiting how the server wrote certain HTTP-derived metadata into its session files. The fix went out quickly. Backports went out fast and reached an unusually wide range of older releases. Hosts around the world spent that day blocking ports, killing proxy domains, and refreshing the cPanel advisory page as it updated by the minute.

This isn’t a post about that specific bug. The bug got fixed, and the cPanel security team did the work quickly. What I want to write about is something I started noticing during and after that incident: the gap between what serious vulnerabilities actually do and how vendors describe them in public.

A note on names. cPanel has been owned by WebPros since 2018. When I refer to WebPros in this post, I mean the company as a whole. When I refer to the cPanel team, I mean the people doing the day-to-day technical work on the product. Same company, not always the same decisions. The technical work I have seen from the cPanel side has generally been good, and the April 28 response was fast and competent. My criticism here is aimed at policy: public vulnerability classification, disclosure handling, and whether published bug bounty programs are applied consistently.

There’s a pattern in vulnerability disclosure that doesn’t get enough attention. A researcher reports a serious bug. The vendor accepts the report, patches it, and then publishes an advisory that describes the issue in language so deflated you’d never know what was actually fixed. A remote code execution vulnerability becomes “an input validation issue.” A privilege escalation becomes “improper access control.” A pre-auth exploit chain becomes “a hardening improvement.”

The bug gets fixed. That part is good. But the way it gets described to the public matters too.

Continue reading