• 🎉 Big News: Circle City Servers is backing our CloudFest Americas coverage. Read more

Security issues

oXnames

oXnames

Active member
Is it me or has software been suddenly been getting a lot of security issues lately, had a few emails of discovered security bugs and issues in cPanel and then today WHMCS.
 
Hi! Yeah, it feels like new vulnerabilities are popping up everywhere lately. I think AI plays a huge role in this because it allows people to find flaws way faster and at scale. It’s pretty much the same trend we’re seeing with AI-powered game cheats—it completely changes the rules for security.
 
Mivocloud said:
Hi! Yeah, it feels like new vulnerabilities are popping up everywhere lately. I think AI plays a huge role in this because it allows people to find flaws way faster and at scale. It’s pretty much the same trend we’re seeing with AI-powered game cheats—it completely changes the rules for security.
Click to expand...
Agreed, I have had 2 for cPanel, 1 for WHMCS and 1 for another software in the industry all in the last 2 weeks.

Crazy!
 
It's quite frustrating to say the very least. Once you upgrade, you find new bugs too. It's difficult to stay on the 'stable release' these days.
 
It is not just you, cPanel/WHM had a serious security bug in late April that let attackers break in without even logging in, and it was already being used by hackers before anyone knew about it. WHMCS had a similar issue soon after. Just make sure both are updated to the latest version.
 
OnTheCloud.co said:
It's quite frustrating to say the very least. Once you upgrade, you find new bugs too. It's difficult to stay on the 'stable release' these days.
Click to expand...
Appreciate the heads-up. The worst thing about billing bugs is you think everything is fine until a scheduled cron or renewal quietly blows up in the background. Definitely going to test checkout and cron runs before calling any update done, particularly since we have custom modules hooked up. Out of curiosity, did the bugs hit core WHMCS, or did a third-party plugin give out?
 
NiceNIC said:
Appreciate the heads-up. The worst thing about billing bugs is you think everything is fine until a scheduled cron or renewal quietly blows up in the background. Definitely going to test checkout and cron runs before calling any update done, particularly since we have custom modules hooked up. Out of curiosity, did the bugs hit core WHMCS, or did a third-party plugin give out?
Click to expand...
One bug that's still a problem is functioning WHMCS Connect, not critical or customer facing. The other bug we found recently had to do with Stripe card payments initiated by the admin not going through, they half fixed that one, but it shows that the payment is initiated by the user.
 
Two things from the provider side, one of which is the boring answer
nobody likes.

On the pre-auth bugs specifically - the cPanel one Cantech mentions,
and the WHMCS ones - patching faster is not really the answer any more.
Mivocloud is right that the window between disclosure and mass scanning
has collapsed. By the time you read the advisory, the scanning is often
already running. The defence that still works is unglamorous: do not
let the management plane be reachable from the whole internet. WHM,
WHMCS admin, panel logins - behind an allowlist, behind a VPN, or at
minimum on a hostname that is not the one printed on every customer
invoice. A pre-auth RCE you cannot reach is not an incident.

Second, offered as context rather than advice: we do not run cPanel or
WHMCS, we built the console in house. The honest trade is that we gave
up an enormous amount of functionality and years of engineering to stay
out of a blast radius where one advisory exposes every host on the same
stack in the same second. For most people that is not a good trade -
the features are real and the engineering is not free. But it is worth
naming that "almost everyone runs the same two products" is itself part
of why these advisories hurt as much as they do.

On NiceNIC's point - a billing bug that surfaces at the next renewal
cron rather than at deploy is the nastiest shape this takes, because
the gap between shipping it and finding out is a full billing cycle.
The only test we trust for that is a real transaction on a real
schedule, not a staging run.
 
oXnames said:
Is it me or has software been suddenly been getting a lot of security issues lately, had a few emails of discovered security bugs and issues in cPanel and then today WHMCS.
Click to expand...
Howdy!
I would agree. WHMCS has been issuing more security updates as well as Enhance (control panel).
Why do I think this is happening recently? AI.
😀
 
You must log in or register to reply here.

Sponsor

Supporters

Back
Top