cPanel Authentication Bypass Zero-Day Exploited in the Wild for Months

Analysis
The months-long pre-disclosure exploitation window, per watchTowr Labs' proof-of-concept and corroborated by CyberScoop and BleepingComputer, points to a threat actor with operational patience and a pre-positioned capability developed for targeted use. With the PoC now public, unpatched hosting providers almost certainly face active exploitation within the 30-day KEV remediation window as commodity operators enter alongside the original actors. Administrative control over cPanel yields command of every site and email account on the server, amplifying intrusion consequences well beyond the initial foothold. Small shared-hosting operators, carrying minimal patch cadence and no intrusion detection, face the greatest downstream exposure, with bulk credential harvesting the more probable outcome than the targeted enterprise intrusions the original zero-day's sophistication implies.