cPanel Vulnerability Weaponized Against Gov, Military, and MSPs

A previously unknown threat actor is actively exploiting a recently disclosed cPanel vulnerability, according to The Hacker News. The campaign specifically targets government and military entities across Southeast Asia. Additionally, managed service providers (MSPs) and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S. have been observed as targets.

This isn’t a spray-and-pray operation. The attacker’s calculus here is clear: hit cPanel to gain broad access. Compromising an MSP or hosting provider offers a force multiplier, giving the threat actor a foothold into numerous downstream customer environments. For government and military targets, the objective is almost certainly intelligence gathering or disruption.

Defenders need to assume these cPanel instances are high-value targets. The rapid weaponization of this vulnerability means patching alone isn’t enough; a thorough forensic review for post-exploitation activity is critical. Attackers are moving fast, and they’re going for the jugular.