cPanel WHM authentication bypass: are your hosting controls patched?

TL;DR: cPanel disclosed a critical authentication bypass in WHM affecting nearly all versions, including end-of-life releases, with exploits already observed before patching, according to Expel. The incident shows how quickly administrative access can collapse when hosting platforms lag on remediation, especially where providers or operators own the patching path.

NHIMG editorial — based on content published by Expel: cPanel WHM authentication bypass vulnerability analysis

Questions worth separating out

Q: What fails when a hosting control plane has an authentication bypass?

A: The failure is the collapse of the boundary between unauthorised traffic and administrative authority.

Q: Why do supported and end-of-life versions create different risk levels in hosting environments?

A: Supported versions can usually be patched quickly, while end-of-life versions often cannot be fixed at all.

Q: How do security teams know whether a control-plane auth flaw was exploited before patching?

A: They look for evidence of administrative actions that should not exist, such as unexpected logins, new accounts, altered permissions, or changes to server configuration.

Practitioner guidance

• Patch WHM as a root-level emergency action Force the update from the server itself so the patched version is retrieved and installed immediately, rather than waiting for a deferred maintenance cycle.
• Verify managed-hosting remediation directly If the environment is not self-hosted, confirm with the provider that the fix has been applied and request evidence of version status on the affected instance.
• Review control-plane logs for pre-patch abuse Search for suspicious login attempts, unexpected account creation, and unusual administrative activity that occurred before the patch was deployed.

What's in the full analysis

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• Version-specific patch guidance for the affected cPanel and WHM releases
• Log-review indicators for suspicious administrative activity before remediation
• Practical steps for confirming whether a managed hosting provider applied the fix
• Exposure context for organisations still running end-of-life hosting builds

👉 Read Expel's analysis of the cPanel WHM authentication bypass and remediation steps →

cPanel WHM authentication bypass: are your hosting controls patched?

Explore further

View Full Forum →  |  NHI Foundation Course →