Once a verified and reproducible report was confirmed, our team made updates available within approximately 28 hours across all supported versions of the platform, as well as select legacy versions. As of today, over 98% of servers worldwide are running an updated version of cPanel & WHM. We continue to provide mitigation options for partners and customers who are unable to apply the update immediately. The complete update regarding patch coverage is listed in the following support article. 

We take security extremely seriously and recognize the urgency this created. We remain focused on supporting our partners and customers. 

What Was Addressed 

CVE-2026-41940 is an authentication vulnerability in cPanel & WHM’s session management layer. Two separate code paths write to session files on disk: one path included an input-sanitisation step; a second path, invoked during Basic authentication handling, did not. The absence of that sanitisation step on the second path created a condition under which a specially crafted request could result in an unauthenticated session being treated as authenticated, granting access without valid credentials. 

The vulnerability affects every version of cPanel & WHM after v11.40, and WP Squared up to v11.136.1.6. VulnCheck has assigned it a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 1 May 2026. No other WebPros products are affected.

For servers on versions that cannot yet be updated, the support article provides mitigation guidance including cpsrvd service port blocking and ModSecurity rule application. We have also published a detection script  that scans session files for the indicators of compromise associated with this attack. Note that, as of 1 May 2026, the script has been refined to remove an earlier false-positive on session.lock files.

How We Responded 

The following sequence reflects how the response unfolded on confirming the vulnerability. 

• 27 April, 10:47 CDT – Vulnerability confirmed and classified. Incident response initiated

• 28 April, 12:08 CDT – Support article (KB 40073787579671) published. Partner collaboration channels opened

• 28 April, 12:30 CDT – Code update merged into v138 and applied simultaneously across v136, v134, v126, v118, and v110

• 28 April, 16:19 CDT – Updated builds published across all supported tiers: LTS, STABLE, RELEASE, CURRENT, and EDGE. Approximately 28 hours from confirmation to general availability 

• 29 April 15:18 CDT – Comprehensive email issued to all partners and direct customers, alongside publication of the indicators-of-compromise detection script. A second coordinated email followed on 1 May with expanded version coverage and additional mitigation measures

From there, the work continued in parallel: back-ports for legacy and end-of-life versions, automated remediation tooling, and direct support for partners working through specific fleet configurations.  

Detection and Auto-Remediation Tooling

Two additional tools supported the broader response alongside the patches. 

The indicators-of-compromise detection script, available at https://support.cpanel.net/hc/en-us/articles/40073787579671 scans session files for attributes associated with this specific exploit. It was refined on 1 May to correct a false-positive on session.lock files identified by partners during their own fleet testing. Any server that was unpatched at any point during the incident window should be scanned using the current version of the script. 

Automated remediation tooling was deployed on our side to accelerate update adoption across the installed base, including a majority of affected builds, a number of end-of-life versions and a dedicated path for CL6/C6 environments accessible via run_security_update. This allowed us to drive patch coverage to over 98% of servers as of today without requiring manual intervention across every affected configuration. Coverage continues to expand through specific mitigation steps outlined in our support article. 

Updates for Legacy Versions  

In addition to all currently supported tiers, we delivered targeted updates for v86, v94, v102, v124, and v130, which have been outside standard support for some time, along with a dedicated update tier for CL6/C6 (CloudLinux 6) environments, available through the run_security_update autofixer.

Each of these required individual engineering work: targeted porting, version-specific validation, and full regression testing before release. 

Working Closely with Partners on Edge Cases 

The update coverage we can report today was built alongside our partners, not independently of them. Over the past week, hosting partners and server administrators have been active participants in the response, and we want to be specific about what that looked like. 

Testing the Detection Script Against Live Fleets 

Several partners ran the detection script across their server fleets in the days after publication and reported edge cases that had not surfaced in our own testing environment. This partner feedback is what produced the 1 May update to the script. Their environments effectively extended our validation coverage in ways that improved the quality of the tooling for everyone. 

Validating Update Behaviour on Non-Standard Configurations 

Pinned, locked, and version-restricted configurations do not always behave the way standard configurations do when an update runs. Partners with these environments worked directly alongside our engineering team to validate tooling behaviour against their specific setups, and to surface update blockers before broader rollout. Several of the back-ports for older version tiers were shaped directly by these conversations: partners described exactly what their fleet was running and why it could not move, and our team built the update path around that constraint. 

Coordinating Customer Communications 

A number of partners aligned their own customer communications with ours, requesting accuracy checks, version-specific guidance, and technical detail they could relay to their support teams. We supported each of these requests directly. The result was a more consistent message reaching downstream customers across a wide range of hosting environments. 

Surfacing Partner-Specific Update Blockers 

In several cases, partners identified conditions specific to their environment that prevented the standard update path from completing and brought them to our attention directly. Our team prioritised each one as part of the incident response rather than routing it through standard support. That prioritisation contributed directly to the pace at which update coverage moved. 

Further Context

During the course of April, we received separate reports regarding a possible pre-authentication issue in cPanel & WHM. For one of the two reports, our team engaged in follow-up correspondence with the person behind it to better understand, categorize and clarify the information provided. With the details available at that stage, we were unable to independently reproduce the reported behavior, and our initial assessment did not confirm a vulnerability. When the second report arrived with additional context, our team was able to reproduce and confirm the vulnerability the same day, and our incident response protocol began immediately.

What We Are Changing 

The following commitments reflect our focus on continuous improvements in security practices, to address an evolving threat landscape. 

Thank You 

Our customers, our partners and their customers, depend on this infrastructure, and that dependency carries a responsibility we take seriously. Our response has been to fix first, move quickly, provide clear and actionable communication, and commit to a continuous improvement in our processes to address a fast-changing threat landscape.  

To the partners who worked alongside our team this past week, testing tooling, working through non-standard configurations, aligning customer communications, and flagging issues as they found them: the update coverage we have achieved is a direct result of that collaboration. Thank you.

To the security community whose scrutiny has kept this incident in clear focus: that scrutiny is appropriate and it produces better outcomes. Thank you.

The support article at https://support.cpanel.net/hc/en-us/articles/40073787579671 remains the live operational reference and is updated continuously.

The post CVE-2026-41940: Response, Actions and Next Steps appeared first on cPanel.

Here’s a look at the top cybersecurity features that make cPanel a trusted choice for secure web hosting in 2025 and beyond. 

1. Proactive Security Updates & CVE Response 

We’re more committed than ever to keeping things transparent and staying ahead of security risks. Throughout 2025, we’ve provided regular security updates to tackle vulnerabilities both within cPanel & WHM and in upstream components such as PHP, Apache, Node.js, and ModSecurity. 

• 15+ CVEs addressed in Q3 2025 alone, including CVE-2025-40929, CVE-2025-6965, and CVE-2025-20260 

• Security patches rolled out for all supported versions: v110, v118, v128, v130, and v132 

• Swift vulnerability responses ensuring users stay protected without disruption 

This proactive approach helps hosting providers maintain a hardened environment with minimal downtime or manual intervention. 

2. SSL/TLS Certificate Management Made Easy 

Security by default is our standard. With AutoSSL, every domain and subdomain hosted on cPanel can automatically receive and renew SSL certificates, including free certificates via Let’s Encrypt. 

Whether you’re using DV or OV validation, cPanel ensures end-to-end encryption for all your hosted domains, making HTTPS accessible to everyone. No more expired certificates or complex setup steps — just seamless, secure encryption for your users. 

3. WordPress Security Through WP Guardian 

WordPress powers millions of websites. Keeping them secure requires a proactive defense solution. That’s why we introduced WP Guardian, a built-in security solution for your WordPress installations. 

• Automatic malware scanning and vulnerability patching 

• Powered by Patchstack for real-time virtual patching without code changes 

• Proactive protection against zero-day exploits and known vulnerabilities 

WP Guardian acts before threats can take hold, keeping your WordPress websites safe, stable, and secure. 

4. Comprehensive Server Protection with Imunify360 

For hosting providers seeking all-in-one protection, Imunify360 is the perfect choice. Through our partnership with Imunify, we offer seamless integration with cPanel for full-stack server security. 

• Multi-layered defense: Firewall, malware scanning, intrusion prevention, and IP reputation management 

• Automated patching to reduce administrative overhead 

• Flexible deployment through Imunify360 or ImunifyAV+ 

This powerful integration ensures that servers stay protected from evolving threats without slowing down performance. 

5. Strengthening Access Security with Two-Factor Authentication (2FA) 

Protecting administrative access is one of the most effective ways to keep servers safe. cPanel supports TOTP-based two-factor authentication (2FA) for WHM and user logins, giving both administrators and end users the ability to secure their accounts with an extra layer of protection. 

By encouraging the use of multi-factor authentication, we help users embrace best practices that significantly reduce the risk of unauthorized access. 

6. Preparing for the CSF Transition 

In August 2025, ConfigServer (CSF) reached end-of-life. Nearly half of cPanel servers relied on CSF, and we heard our customers loud and clear. 

We’re actively exploring native firewall solutions and enhanced integration with Imunify360 to ensure smooth transitions and continuous protection. Learn more about our CSF sunset response: The End of ConfigServer. 

Our goal remains simple: to deliver a customer-first approach to server security that evolves with your needs. 

7. Continuous OS & Software Updates 

A secure hosting stack depends on staying up to date. Through EasyApache 4, cPanel delivered 41 releases in 2024, addressing over 61 CVEs across PHP, Apache, and related technologies. 

We also provide modern OS support and upgrade tools like ELevate, ensuring hosting environments can safely migrate to newer distributions to stay current with OS level security updates and features. 

8. Built-In Security Advisor & Monitoring Tools 

Security isn’t a one-time action. It’s an active, ongoing process. That’s why cPanel includes tools that help users monitor, identify, and respond to potential issues before they become threats. 

• Security Advisor: Offers clear, actionable recommendations to improve your server’s security posture 

• cpHulk: Provides built-in brute force protection 

• Real-time monitoring for server health and security metrics 

With these insights, we aim to simplify and strengthen the way you maintain a secure environment.

Keeping Servers Safe, Together 

Cybersecurity is a shared responsibility. At cPanel, we remain committed to helping our partners and users stay ahead of threats with a secure, transparent, and continuously improving platform. 

Stay secure. Stay updated. Stay ahead, with cPanel. 

The post Strengthening Server Security: Top Cybersecurity Features in cPanel appeared first on cPanel.

However, misconfigurations and overlooked settings can leave your server vulnerable to attacks. This can lead to irretrievable data loss, increased costs, legal and compliance issues, and malware infections, to name just a few of the biggest problems.  

That’s why we’ve compiled the information in this post: the ultimate cPanel security checklist! We’ll cover the essential security measures that every sysadmin should implement. From firewall configuration and backups, all the way to SSL certificates and intrusion detection, this guide will help you fortify your cPanel server against potential threats. 

Let’s get to it!  

Summary of What You’ll Learn 

• Use a step-by-step checklist to secure your cPanel servers. Such as strong passwords, two-factor authentication, and IP access to prevent unauthorized logins and brute-force attacks 
• Focuses on best practices for system administrators to prevent cyber threats and unauthorized access 
• Enable automated and remote backups, test them regularly, and always stay up to date with cPanel, WHM, and third-party software. 
• Aims to help admins maintain a secure, compliant, and high-performance hosting environment 

1. Secure Your cPanel Login 

Use Strong Passwords and Two-Factor Authentication (2FA) 

Ensuring both you and all cPanel and WHM users have the correct password and security protocols set up is the first step towards a safe environment.  

• Ensure that all cPanel and WHM users have strong, unique passwords. For specific help with configuring this, follow the guide here.  
• Enforce Two-Factor Authentication (2FA) via WHM > Security Center > Two-Factor Authentication. 
• Disable the “root” user login and use sudo-enabled accounts instead. 

Restrict Access by IP Address 

• Set up IP-based access control to high privileged or admin accounts by restricting logins to specific IPs. 
• Use cPHulk Brute Force Protection to block repeated failed login attempts. 

2. Secure the cPanel Server with Firewalls 

Firewalls help you filter traffic, prevent unauthorized access, mitigate attacks, and help you monitor logins, to name just a few of the ways they keep your environment safe.  

Install and Configure CSF (ConfigServer Security & Firewall) 

• Install ConfigServer Security & Firewall (CSF) to manage network traffic and block suspicious activity. 
• Enable Login Failure Daemon (LFD) to detect repeated login failures. 
• Whitelist trusted IPs and blacklist known malicious ones. 

Close Unused Ports 

• Disable all unnecessary ports to minimize entry points for attackers. 
• Use WHM > Security Center > Host Access Control to control access. 

Enable ModSecurity 

• Navigate to WHM > Security Center > ModSecurity Configuration. 
• Ensure that OWASP ModSecurity Core Rule Set (CRS) is enabled to protect against common web vulnerabilities. 

3. SSL and Encryption Best Practices 

Following best practice for SSL and encryption ensures a continued level of trust between you and your users and keeps all your data (and theirs!) protected.  

Enforce SSL for cPanel, WHM, and Webmail 

• Enable AutoSSL in WHM > Manage AutoSSL to provide free SSL certificates. 
• Force SSL redirection in WHM > Tweak Settings > Require SSL for cPanel Services. 

Disable Weak SSL/TLS Protocols 

• Navigate to WHM > Service Configuration > Apache Configuration > Global Configuration. 
• Disable TLS 1.0 and 1.1, ensuring only TLS 1.2 and 1.3 are allowed. TLI 1.0 and 1.1 are deprecated and no longer part of best practice.  

Use Strong Cipher Suites 

• Modify your Apache or Nginx configuration to allow only secure cipher suites by following this guide.  
• Test your server security using Qualys SSL Labs (https://www.ssllabs.com/ssltest/). 

4. Secure User Accounts and Permissions 

This step is incredibly important in order to prevent unauthorized access to your system, as well as to maintain data integrity and minimize insider threats. In general, it’s always best to follow the Least Privileges Principle when you assign roles and permissions to users.  

Implement CageFS within CloudLinux 

• Install CloudLinux for improved security and resource allocation. 
• Use CageFS to isolate user accounts and prevent cross-account attacks. 
• Restrict File Permissions 
• Set secure file permissions by following the FileProtect documentation here. 

Disable Shell Access for Non-Admins 

• Go to WHM > Account Functions > Manage Shell Access and disable shell access for all non-admin users. 

5. Regular Backups and Disaster Recovery 

Regular backups might seem like a simple task, but you’d be surprised how many companies have been the victims of data loss due to not sufficiently backing up. One survey on this subject from 2024 concluded that over 80% of organizations lost data due to not backing up enough, so don’t think it can’t happen to you too!  

Enable cPanel Backups 

• Configure Automated Backups via WHM > Backup > Backup Configuration. 
• Store backups on a remote server to prevent loss in case of an attack. 

Test Your Backups 

• Regularly restore a backup in a test environment to verify integrity. 
• Use Incremental Backups 
• Enable Incremental Backups to reduce storage space while maintaining recent changes. 

6. Secure Database and PHP Settings

This part of the process is incredibly important for securing sensitive data and ensuring data integrity, as well as preventing code injection and enhancing performance.  

Protect MySQL Databases 

• Restrict MySQL access to localhost unless required. 
• Use strong, unique passwords for database users. 
• Disable MySQL SHOW DATABASES for non-root users. 
• Follow the guide here for a more detailed explanation. 

Harden PHP Configuration 

• Edit /etc/php.ini and set: disable_functions = exec,passthru,shell_exec,system 
  expose_php = Off 
  allow_url_fopen = Off 
• Enable open_basedir restriction in WHM > MultiPHP Manager. 
• For a more specific set of configurations and assistance, follow the guide here. 

7. Enable Intrusion Detection and Security Logs 

This part of the process is incredibly important for real time threat detection, identifying vulnerabilities, as well as compliance!  

Install and Configure Fail2Ban 

• Install Fail2Ban to monitor and block suspicious login attempts. 
• Configure rules to ban IPs after repeated failed logins. 

Monitor Logs for Suspicious Activity 

• Regularly check security logs, this blog can be helpful in learning how! 
• Set up log monitoring alerts to notify you of unusual activity. 

8. Keep Software and Plugins Updated 

This might seem basic, but again, sometimes the easiest and simplest parts of security processes are the ones we take for granted, and therefore the ones it’s easy to forget about and miss.  

Regularly Update cPanel and WHM 

• Enable automatic updates in WHM > Update Preferences. 
• Regularly check WHM > cPanel Version Information for updates. 

Update Third-Party Plugins and Applications 

• Ensure WordPress, Joomla, and other CMS applications are up to date. 
• Use WordPress Toolkit to manage WordPress security settings. 

Remove Unused Plugins and Themes 

• Disable and delete any unused plugins to minimize security risks. 

9. DDoS Protection and Network Security 

Ensuring you’re compliant with this part of the process helps to prevent service interruptions, safeguard your reputation, as well as reducing financial losses and protecting sensitive data. 

Use Cloudflare or a WAF 

• Integrate Cloudflare to provide DDoS protection and web application firewall (WAF). 
• Enable Imunify360 for advanced malware protection. 

Implement Rate Limiting 

• Configure ModEvasive to protect against brute-force attacks. 
• Set up rate limiting for login attempts. 

Use CDN for Improved Security 

• Implement Content Delivery Networks (CDN) to reduce server load and protect against attacks. 

10. Security Audits and Best Practices 

Performing regular security audits on your cPanel environment is vital to keeping your users’ data safe, and their trust in you high. 

Conduct Regular Security Audits 

• Use cPanel Security Advisor (WHM > Security Advisor) to check for vulnerabilities. 
• Perform manual security audits every quarter. 

Educate Users and Staff 

• Train users on secure password policies and phishing awareness. 
• Subscribe to Security Updates 
• Stay updated on cPanel security patches and apply them immediately. 
• Subscribe to cPanel’s security mailing list for alerts. 

Conclusion 

As you know, securing your cPanel server is an ongoing process, one that requires constant diligence and proactive management. By following our cPanel security checklist, you can significantly reduce the risk of security breaches and maintain a safe hosting environment, ensuring your team members and customers stay safe.  

Regular updates, strong password policies, firewalls, backups, and active monitoring are key components of a strong security posture. Implement these measures today to safeguard your cPanel server against evolving cyber threats. 

Frequently Asked Questions (FAQs) 

The post The Ultimate cPanel Security Checklist for Sysadmins appeared first on cPanel.

The short-term savings hide long-term dangers that can compromise your entire server or website. In this post, we dive deep into the hidden risks associated with using fraudulent cPanel licenses and why the true cost is far higher than the license fee you avoid. 

Understanding Fraudulent cPanel Licenses 

A fraudulent cPanel license is one that has not been legitimately purchased directly from cPanel or an authorized partner. These licenses are often obtained illegally, bypassing the official activation and validation processes. 

Wondering how users end up with these unlicensed accounts? Often, it’s through attractive offers for “cheap cPanel hosting” or “cheap cPanel licenses” advertised on different forums or websites. These sellers might offer what looks like a working cPanel installation, but it’s built upon an illegal licensing foundation. Sometimes, users might even be unaware that they are receiving an unlicensed product, totally misled by the vendor’s claims. 

Hidden Risks and Dangers You Can’t Afford to Ignore 

The consequences of using a fraudulent cPanel license don’t just include a conflict of ethics. Fake licenses pose serious threats to the security, stability, and legality of your servers and websites. 

Security Vulnerabilities 

Fraudulent cPanel licenses are often tampered with. They can have malicious code or backdoors or even be intentionally left unpatched in order to create significant security holes.

Hackers actively seek out servers running unlicensed software because they are easy targets. They can use these vulnerabilities to steal sensitive data, infect your server and your visitors with malware, launch phishing attacks, or even take complete control of your server.

Want to learn how to protect your server? Check out our cPanel Security Best Practices.

Lack of Support 

By using a fake license, you’re working outside of the official cPanel ecosystem. This means you are not entitled to any official support from cPanel.

You won’t have access to cPanel’s expert support team, leaving you to diagnose and resolve potentially critical problems by yourself which can lead to extended downtime and a compromised server. If you meet technical issues, bugs, or security threats, you’re on your own.

Legal Consequences 

Software licenses are legal agreements. Using unlicensed software is a violation of copyright and licensing laws. cPanel actively monitors for fraudulent licenses, and if your server is identified, you could face legal repercussions. This can include significant fines and penalties, and in severe cases, facing legal action that could force your website and services offline. 

Performance Issues 

Non-official licenses might be outdated or improperly optimized. These versions can lack the latest optimizations and updates of official licenses, leading to significant performance problems.  

You might experience slow website loading times, frequent downtime, errors, and crashes. This not only frustrates your users but also harms your online reputation. It can also negatively impact your search engine rankings. 

The Danger of Fraudster-Operated Update Mirrors 

Some providers of fraudulent licenses run their own unofficial update mirrors. This allows servers with fake licenses to seemingly receive updates, giving users a false sense of security. However, these mirrors are not verified or controlled by cPanel.  

The people running them could decide to replace certain packages with their own versions at any time. This means that even when you think you’re updating your server, you could actually be installing malware or creating new vulnerabilities. These unofficial mirrors expose your server to third-party exploits and put your data at extreme risk.  

How to Identify and Avoid Fraudulent Licenses 

There are clear steps you can take to protect yourself:

• Verify your license: The first step is to verify the authenticity of your cPanel license.
• Purchase from official sources: To avoid the risks altogether, purchase your cPanel license directly from the official cPanel website or through an authorized cPanel Partner. A list of official partners is available on the cPanel website.
• Question “cheap” offers: Always keep in mind that if a deal seems too good to be true, it probably is. Legitimate cPanel licenses have a standard pricing structure, and big deviations should raise red flags for you at once.

Conclusion 

The short-term savings of using a fraudulent cPanel license are an illusion. They come at the expense of your security, reliability, legal standing, and performance. The hidden dangers and potential consequences just aren’t worth the risk. From critical server and site vulnerabilities to the complete lack of support available if things go wrong, using an unlicensed cPanel account puts your entire online presence in jeopardy.

If you are currently using a fraudulent cPanel license, we strongly urge you to switch to a legitimate license as soon as possible. Don’t compromise your online security and reputation for the sake of a “cheap” deal. By buying a legitimate cPanel license you’ll receive the best benefit of all: total peace of mind.

The post The Hidden Dangers of Using a Fraudulent cPanel License  appeared first on cPanel.

With cPanel & WHM’s Server Monitoring powered by 360 Monitoring, administrators now have access to powerful tools that ensure service quality and uptime are maintained with ease. This new integration transforms server management into a continuous, automated monitoring process that identifies potential problems before they arise. Whether you’re overseeing a single server or an entire network, Server Monitoring’s advanced features can handle any site or use case. 

Why Monitoring Matters 

How much time do you spend reacting to server issues; website load times, security breaches, or email delivery failures? Instead of always stressing to fix problems as or after they arise, Server Monitoring transforms your server management strategy from reactive to proactive.  

Smart, Automated Monitoring for Smooth Server Management 

Smartly configured, automated monitoring can be your first line of defense in maintaining service quality standards. By actively monitoring key performance metrics and sending real-time alerts, Server Monitoring ensures that your website stays online, your email delivers properly, and your server operates at its best. This means you can avoid the stress of unexpected outages and performance issues, allowing for smoother operations and less time spent troubleshooting. 

Advanced Monitoring Features for Every Need 

Whether you’re a beginner or an experienced server administrator, WHM’s Server Monitoring offers a comprehensive suite of features designed to fit every use case. From keeping track of website performance to ensuring your server is secure and compliant, the flexibility and sophistication of these tools make them a must-have for any server management routine. 

Key Applications for Server Monitoring: 

• Website Performance Monitoring 
  Ensure your site is always accessible to visitors by tracking uptime, response times, and server resource usage. With real-time alerts, you’ll be able to address issues before they impact your users’ experience. 

• Email Deliverability 
  Monitor your server’s IP address against Realtime Blackhole Lists to prevent email delivery issues. This is a game-changer for maintaining high email deliverability, keeping your emails out of spam folders, and avoiding unnecessary support tickets. 

• Security Monitoring 
  Protect your server from security threats by using the uptime and performance monitoring features to detect unusual activity, like unexpected spikes in resource usage or downtime, that could indicate a security threat. 

• Resource Optimization 
  Track critical resources such as CPU, RAM, and disk I/O usage to optimize your server’s performance. This allows you to prevent overloads and ensure your server can handle peak traffic without slowing down. 

• Compliance Monitoring 
  Use the built-in web crawler to identify non-compliant GDPR assets, broken links, or JavaScript errors on your website, to ensure your site remains legally compliant and user-friendly. 

Seamless Integration with WHM: A Tool for Every User 

One of the standouts of Server Monitoring is its integration with WHM, offering a unified, customizable dashboard experience for both non-technical users and advanced server administrators. 

• If you’re new to server management, WHM’s Server Monitoring is designed to be intuitive and user-friendly. With ready-made dashboards, you’ll be able to monitor key server metrics like CPU usage, memory, and disk space without the need for any technical expertise. The clear, concise metrics help you spot potential issues quickly, and real-time alerts ensure you can act before problems escalate. 

• For more experienced users, get ready to dive into sophisticated metrics such as server response times and uptime, and integrate your alerts with your most-used tools and platforms, like Slack, Discord, and PagerDuty. The smart configuration options ensure you can create the monitoring setup that works best for your workflow. 

Maximize Uptime, Minimize Stress 

With Server Monitoring, you’ll have the tools to monitor and respond to issues quickly, maximizing uptime and ensuring that your business stays online and performs at its best. 

• Avoid Outages 
  Keep tabs on downtime, port tracking, Time to First Byte, and performance metrics across multiple locations to ensure your website is running smoothly, no matter where your users are. You can even display a public status page to inform visitors if there’s an ongoing issue and keep them updated during troubleshooting. 

• Monitor Business Reputation 
  Ensure your emails don’t end up in spam by actively monitoring your server’s IP reputation. Prevent email delivery problems before they escalate into larger issues, reducing the risk of support tickets and improving customer communication. 

• Customizable Alerts for Quicker Customer Responses 
  Receive notifications through your preferred channels, e.g. text, email, Slack, etc., if your server reaches critical thresholds. This means you can respond instantly to customer issues and prevent errors from turning into larger problems. 

Ready to Experience Proactive Monitoring? 

Excited to experience the perfect blend of simplicity and sophistication in server management? By integrating Server Monitoring into your WHM setup, you can ensure your service quality standards are always maintained, while also gaining the peace of mind that comes with proactive monitoring.  

Visit the cPanel store to purchase your plan today. For more detailed information on setting up and configuring Server Monitoring, check out the full documentation.  

The post A Proactive Approach to Server Management with cPanel & WHM  appeared first on cPanel.

Warning Signs

Do you ever encounter pricing for a high cPanel license tier that seems almost too good to be true? Do you attempt to contact your license provider for cPanel troubleshooting only to get the run-around? Does your license provider or host need to frequently “replace” the installed cPanel license on your server? These are some indicators of red flags with fraudulent retailers.  

Fraudsters will also claim that they are using a “GPL” version of a cPanel license to back up their false claim of legitimacy. GPL stands for General Public License, a license type that allows users to copy, modify, and otherwise share applicable software for distribution as they see fit. To be clear, there are no GPL versions of cPanel & WHM. 

The Risks

Due to how cPanel’s licensing system functions, fraudsters need to go to great lengths to “crack” the mechanisms we have in place by configuring license circumvention scripts and software. This software is installed at the root level and almost always contains additional backdoors. Independent security investigations have found known compromises related to these licenses. 

Because these licenses also try to evade our licensing servers, they often will not receive important updates containing vital security patches. This can leave your server and website vulnerable to third-party exploits. 

In the event a user of a circumvented license reaches out to cPanel support for assistance, unfortunately, we must consider the associated server as root compromised, and we will not be able to provide support. The only actions that can be considered to address a root compromised server reasonably are to perform a fresh Operating System and WHM/cPanel installation and restore account backups, or to migrate the accounts to a known clean server that has not been previously root compromised. 

Is My License Legitimate?

You want to believe you can trust a vendor, but if some of the red flags we outlined above sound all too familiar then you need to verify claims that the license you purchased from them is legitimate. Fortunately, verify.cpanel.net is free and easy to use at any time.

How to verify a license

1. Navigate to verify.cpanel.net
2. Input your server’s IP address and click “Verify License”. If you do not know your server’s IP address, access your server via terminal and run the following command: curl -L https://cpanel.net/myip 
3. A legitimate cPanel license will appear like this: 

• A license purchased directly from the cPanel store, with an “Active” status: 

• A license purchased via a verified Partner (in this example, Siteocity), with an “Active” status: 

4. A fraudulent license will appear like this:

Or, sometimes using an inappropriate license type such as:

A note on DNSOnly licenses

The cPanel DNSOnly license type is for the creation of dedicated nameservers and can replicate DNS zones to create a DNS cluster with other servers. This license type is not intended to serve actual website data and therefore, cannot be used to create cPanel accounts. Fraudulent license providers often circumvent our licensing system with the use of cPanel DNSOnly license types.  

What Do I Do Now?

As previously mentioned, we consider any servers the fraudulent licenses are associated with as root compromised. Firstly, you must procure a new server to prepare for a migration of your cPanel/WHM server data. If you also purchased hosting services from the same vendor of the fraudulent license, cPanel has a directory of verified Partners with a variety of hosting options to choose from. 

These verified Partners will also bundle cPanel & WHM licenses with their hosting services. Alternatively, purchase a license directly from store.cpanel.net if you are self-hosting. 

With a new server and valid license in hand, it is time to migrate your website data to your new server. If you still have access to the old server with the license intact, you can utilize Transfer Tool to automate the migration.

If you find that the circumvented license is non-functional, sites and configuration files will need to be migrated manually. We have guides available to help you in the manual transfer process, using either cpconftool script or using pkgacct and restorepkg.

A Helping Hand 

If you have any questions about cPanel licensing, feel free to reach out to one of our verified Partners through our PartnerNoc directory, partnernoc.cpanel.net. Alternatively, contact cPanel Customer Service directly.

By staying informed, using the tools provided, and working together, we can protect our businesses and ensure a secure cPanel ecosystem for all. 

The post From Detection to Action: Handling Fraudulent cPanel & WHM Licenses appeared first on cPanel.

ARC is an authentication method designed to verify the legitimacy of forwarded emails and emails sent from mailing lists. Acting as a digital signature, ARC adds three message headers to an email: authentication results, a message signature, and a seal header. 

By implementing ARC, Google aims to enhance email security and prevent spam and phishing attacks. Emails sent to Google without ARC are at risk of being marked as spam or rejected entirely, significantly impacting deliverability and communication reliability. 

For more information about Google and ARC specifically, please refer to Google’s documentation. 

Impact on cPanel & WHM

To maintain seamless email functionality for our users, we integrated experimental support of ARC into cPanel v122. This update ensures that your emails reach their intended recipients without issue. 

Currently cPanel & WHM’s experimental ARC support only applies to outbound headers. 

Please note: ARC is NOT ENABLED by default. Both DKIM and SPF must be enabled to use ARC. Review our documentation to make sure those DNS records are set up for your domains:

• Enable DKIM/SPF Globally 
• Email Deliverability in cPanel (per domain DKIM/SPF management)

Once DKIM and SPF are enabled, you can log into WHM and navigate to Service Configuration > Exim Configuration Manager > Basic Editor > Mail tab to enable ARC signing to outgoing mail. Here is an example of what those ARC headers look like on a message sent from a cPanel mail server: 

cPanel is dedicated to providing a smooth transition for our users and maintaining the reliability of our email platform. We encourage our users to evaluate if ARC support is compatible with their current mailing list or email forwarding setup for uninterrupted delivery. 

The post Introducing Experimental ARC Support appeared first on cPanel.

As promised in the v6.3 announcement, WP Toolkit is back again with another major release. With v6.4 we introduce to you, Vulnerability Protection, and more! Let’s go over the changes in detail together.

Vulnerability Protection: Safeguarding Your WordPress Sites

Our new WP Guardian offering finally comes to WP Toolkit, bringing vulnerability protection for WordPress sites. This is a huge change for WordPress security and there’s a lot to unpack here. What is vulnerability protection? How does it work? What problems it aims to solve? Why it’s important?

Addressing Key Challenges:

1. New Vulnerabilities: When new vulnerabilities rear their heads, WordPress domains are at their most fragile, with fixes often lagging behind. Vulnerability protection ensures site security during this critical period.
   
2. Abandoned Sites: Neglected domains, left to languish or abandoned, present a menace to server and domain integrity. Vulnerability protection erects barriers against such domains metamorphosing into potential threats to the entire server. 
   
   
   

How Does It Work:

Protection is a service continuously working in the background, like an antivirus or a firewall. Enabling protection on a site installs a small worker plugin inside your WordPress. This plugin monitors your WordPress assets (plugins, themes, and WordPress core), constantly checking if they have any dangerous vulnerabilities. When such vulnerability is found, the plugin automatically downloads and applies special protection rules that prevent this vulnerability from being exploited on the site. After vulnerable asset is updated and vulnerability is removed by the update, protection rules are unapplied automatically.

This approach ensures minimal performance overhead, as protection rules (also known as virtual patches) are very small and they’re applied surgically, only for those vulnerabilities which are actually present on a site. Moreover, since these protection rules work similar to firewall rules, they do not modify or change the site code itself in any way, ensuring its integrity.

To Recap, vulnerability protection is:

• Automated: Protection works continuously and automatically, protecting the site from current and future vulnerabilities without user involvement.
• Non-invasive: Protection rules work like a firewall, so they never modify the site code.
• Lightweight: Protection rules are applied only for specific vulnerabilities present on a given site, so they have minimal effect on site performance. (Premium feature)
  
  

Does it work on all vulnerabilities?

Vulnerability protection only neutralizes high and medium risk vulnerabilities. If you see a vulnerability that isn’t neutralized yet, it means one of the following:

• Work in progress. Rules for high-risk vulnerabilities are usually made available within hours of vulnerability disclosure. Rules for medium risk vulnerabilities might take days to be created due to lower impact.
• Low risk. Some vulnerabilities have minimal impact on a site or lack real exploit methods. Since they do not present a real threat to websites, protection rules for them are not necessary (or, in some cases, plain impossible to verify).
• Missing in database. Vulnerability protection is powered by technology provided by our security partners from Patchstack, so it works with vulnerabilities in Patchstack database. Vulnerabilities that are present only in Wordfence database or not matched with corresponding entries from Patchstack database do not receive protection rules. We’re working on matching all possible duplicates between two databases, but it will take us some time, since there are thousands of entries to be matched.
  

How do I get this feature?

Vulnerability protection (also known as virtual patching) is a part of the WP Guardian platform. It requires purchasing a separate license called WP Guardian (cPanel Add-On).

How do I control who gets this feature?

Packages in WHM now include a separate limit for the number of sites that can use vulnerability protection. This limit is set to zero by default to make sure resellers and customers cannot see this feature unless server administrator wants them to. In other words, only server administrators are able to see this feature and its purchase prompts out of the box. If you want to disable this feature completely (so that even server admin can’t see it), or if you’d like to configure the upsell links presented in WHM part of WP Toolkit, do the following:

* Navigate to manage2.cpanel.net and log in,
* Select Update Company Information and scroll down to the Sales Option section
* Change Purchase WP Guardian (cPanel Add-On) item to Custom Store (which will prompt you to specify your own store URL) or Do Not Sell (which will completely hide the feature).

We hope that vulnerability protection feature will make millions of WordPress websites managed by WP Toolkit safer, contributing to the overall health of the WordPress ecosystem.

Risk Rank and Vulnerability Filtering: Streamlining Vulnerability Management

You might remember that WP Toolkit v6.3 has introduced the integration with Wordfence database. Now site admins around the world could see even more vulnerabilities on their websites! But do you know what’s better than seeing more vulnerabilities on your sites? Feeling the magical bliss from not seeing any pointless ones:


The image above is what site admins will see in v6.4 after installing a fresh copy of WordPress.

Wordfence database has introduced a number of vulnerabilities in WordPress core unlikely to ever be fixed by the WordPress team. These vulnerabilities are low-risk, theoretical, not-likely-to-be-exploited-ever, and so on. In other words, they were not important enough to really care about, and they weren’t getting a fix any time soon — but since they were present, site admins got vulnerability warnings on basically all WordPress sites without being able to do anything about it. This made vulnerability alerts pointless, since people were quickly getting alert fatigue. There was no way to differentiate between things you should take care of (dangerous or exploited vulnerabilities) and things you could simply ignore (like these low-risk WordPress core vulnerabilities), so people started to just ignore everything. This needed to be fixed, the sooner the better, and we did just that.

So, what did we do and how did we do it?

WP Toolkit v6.3 has also introduced the vulnerability filtering feature. It utilized a user-provided CVSS score threshold to hide vulnerabilities below the specified score. The main problem was that CVSS rating used for filtering vulnerabilities is difficult to understand for non-tech users (“what number I’m supposed to use as a threshold?“) and, without going into details, it’s not always accurately reflecting the actual severity of WordPress-specific vulnerabilities. We’ve set out to replace CVSS with our own internal Risk rank that’s calculated based on CVSS, EPSS, Patchstack Patch Priority and some other markers.

Our Risk rank does a much better job at reflecting the actual severity of WordPress vulnerabilities, so we’ve switched the filtering from CVSS to Risk rank. We have also enabled this filtering by default, meaning that all vulnerabilities with “low” risk rank will be hidden and ignored after the upgrade to WP Toolkit v6.4. This is how it looks now:

This solution gives a better out-of-the-box experience (no more warnings that your WordPress is vulnerable on a fresh install), doesn’t annoy users, retains the value of Wordfence database where it’s actually needed (there are some genuine vulnerabilities only present in the Wordfence database at the moment), and leaves the control in the hands of users. And yes, we’ve checked and confirmed that all these “annoying, low-score, won’t be fixed” WordPress core vulnerabilities reported by Wordfence will be correctly filtered out, so unless end-users explicitly disable the filtering, it should be smooth sailing with no distractions from that moment on.

Preinstallation of WordPress & Sets on cPanel: Simplifying Site Provisioning

All cPanel packages now have a package extension with WP Toolkit option for preinstalling a WordPress site when the account with this package is created. Another option allows to choose which set should be automatically installed together with WordPress. This set will be installed every time a new WordPress site is installed under the corresponding account.



Disclaimer: This feature fully works when used via GUI, but it might have limited availability via API for now. We’re working on making it available via API as soon as possible.

Bug fixes & Improvements: Ensuring a Smooth Experience

WP Toolkit Version 6.4 also includes numerous bug fixes and enhancements borne out of user feedback, enhancing overall product stability and performance.

The Road Ahead

Our next stop on the road ahead is working on improving the performance of WP Toolkit, together with several bugfixes, long-requested features, and further improvements for the upcoming updates. Stay tuned.

The post Introducing WP Toolkit v6.4: Vulnerability Protection with Patchstack. appeared first on cPanel.

No Action Required by Default on Your End

At cPanel, we prioritize the security of your hosting environments. Therefore, we provide you with important information regarding the recent Zero-Day vulnerabilities that have been disclosed for Exim, the message transfer agent (MTA) used on millions of systems worldwide.

Based on our latest risk assessment and understanding of the defect reports, no further action is required from your side. Further changes in cPanel & WHM of any version are not needed.

What is Exim?

Exim serves as a robust message transfer agent (MTA) initially created at the University of Cambridge for Unix systems that maintain internet connectivity. This versatile MTA boasts a widespread presence across millions of systems globally and has a track record of encountering noteworthy security challenges.

Risk Assessment: Understanding the Zero-Day Disclosures

Here is what we currently know about the Zero-Day vulnerabilities recently disclosed through the Zero Day Initiative (ZDI):

CVE-2023-42115:
Exim addressed issues specific to external authentication. If you are using cPanel Exim with the default settings, you are not vulnerable to this issue unless the ‘external’ authentication driver is explicitly enabled.

CVE-2023-42114 & CVE-2023-42116:
Exim fixed vulnerabilities related to SPA (Secure Password Authentication) and NTLM (NT LAN Manager). By default, cPanel Exim is not vulnerable to these issues unless the ‘SPA’ authentication driver is activated.

CVE-2023-42117:
There is a known defect related to proxy protocol usage in Exim. This only poses a risk if your mail traffic is being proxied to your server, and the proxy is untrusted. We recommend verifying the trustworthiness of your proxy.

CVE-2023-42118:
A vulnerability related to libspf2 has been patched by cPanel to protect against integer underflow. However, due to limited details in ZDI’s reports, the exact nature of the problem remains unknown.

CVE-2023-42119:
Another unknown issue has been reported, this time related to dnsdb, cPanel Exim builds with dnsdb in version 102 and later. If you do not use smart hosts, you are not at risk. However, if you have manually added a dnsdb configuration in any version of cPanel & WHM, please review your settings.

Your Safety First

Your security is of utmost importance to us, and we will continue to monitor this situation closely. Rest assured, our team is dedicated to keeping your hosting environments secure and up-to-date.

If you have any questions or concerns about any potential vulnerabilities or any other security-related matters, please do not hesitate to reach out to our support team. We are here to assist you in every way.

The post cPanel Vulnerability Report: No Actions Required by Default appeared first on cPanel.

Log4j is developed by the Apache Foundation and is widely used by both enterprise apps and cloud services. It was reported by Alibaba Cloud’s security team to Apache on November 24. They also revealed that CVE-2021-44228 impacts default configurations of multiple Apache frameworks, including Apache Struts2, Apache Solr, Apache Druid, Apache Flink, and others. The United States Cybersecurity and Infrastructure Security Agency also issued a statement from CISA Director Easterly on the log4j vulnerability. 

How does this impact my cPanel server? 

The same day the vulnerability was announced, we published an update with the mitigation for CVE-2021-44228 to the cpanel-dovecot-solr RPM in version 8.8.2-4+. The only service provided by the cPanel software that uses the logging utility Log4j is cpanel-dovecot-solr. If you do not have this installed, then your server is secure. This patch will automatically be applied during the nightly updates if this package is installed. On new installations of Dovecot_FTS it will include the patched RPM by default. You can join the discussion on the cPanel Forums log4j-cve-2021-44228 thread. You can check if this RPM is installed by running the command below.

On RPM based versions 

# rpm -q cpanel-dovecot-solr --changelog | grep CVE-2021-44228  

On Ubuntu based versions 

# zgrep -E CVE-2021-44228 /usr/share/doc/cpanel-dovecot-solr/changelog.Debian.gz  

Example if installed: 

# rpm -q cpanel-dovecot-solr  

cpanel-dovecot-solr-8.8.2-4.11.1.cpanel.noarch 

Additional Information 

Our Technical Support team has also published a knowledge base article regarding the Log4j vulnerability titled ApacheSolr vulnerability CVE-2021-44228 for Log4j. If you have any additional questions or need further assistance, please open a ticket at support.cpanel.net.  

Update for December 15, 2021 

The Apache Logging team released an update after it was discovered that certain non-default configurations were still vulnerable to the log4j exploit. We released an updated patch with additional mitigation into our cpanel-dovecot-solr. Learn more about CVE-2021-45046. You can also read the Apache Logging site’s Security page for more information.  

References: 

• New Zero Day Exploit for log4j Java Library is an Enterprise Nightmare (Bleeping Computer) 
• Apache Solr Affected by Apache log4j-cve-2021-44228  
• cPanel Community Forums logj4-cve-2021-44228 thread  
• Second Log4j vulnerability discovered, patch already released 

The post The Apache Log4j exploit and how to protect your cPanel server appeared first on cPanel.