cPanel Exploited: Over 40,000 Systems Compromised Globally
Cyber News - Erez Dasa reports that a critical vulnerability in cPanel is being widely exploited, with over 40,000 systems compromised worldwide. Attackers are leveraging this flaw for both defacement and ransomware operations. This widespread compromise highlights the immediate risk to organizations relying on cPanel for server management.
While ShadowServer data indicated around 110 internet-accessible cPanel instances in Israel, this number has significantly dropped to 12, suggesting many administrators have taken action to block external access to their interfaces. However, the global scale of this exploitation means many more systems outside of Israel remain vulnerable and exposed.
What This Means For You
- If your organization uses cPanel, immediately verify that all instances are patched to the latest version. Audit access logs for any unauthorized activity and consider restricting direct internet access to the cPanel interface, enforcing access via VPN or bastion hosts.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
cPanel Exploit - Suspicious URI Pattern
Written by SCW Threat Desk