Critical cPanel Flaw Exposes Control Panels Without Credentials, New Phishing Toolkit Challenges MFA Security
Vulnerability coverage focused on affected versions, exploitability and patch or mitigation decisions.
By: Artur Ślesik
Published: May 04, 2026
Incident status: Resolved or patched
Corroborating sources: 1
Technical review credentials: Security+ evidence | RHCSA evidence | JNCIS-SEC evidence
Trust note:This alert is maintained under HackWatch's editorial policy, with visible source records, a named responsible editor and a correction channel for disputed facts.
The published article is checked against public sources before publication, and material corrections are reflected in the article update date.
Technical reviewer note: Marcin Pocztowski reviewed this alert on May 04, 2026 for server impact, affected-version evidence, privilege or code-execution claims and realistic patch priority. His remediation note follows the same discipline he would use around Juniper routers and production servers: verify scope, preserve useful logs, reduce exposed management access and only then apply the fix or compensating control supported by the 1 corroborating source.
Review our editorial policy or send corrections to [email protected].
Resolved or patched. Source coverage indicates that a fix or formal remediation has been published. Verify that updates are applied in your environment.
A critical vulnerability in cPanel and WebHost Manager allows unauthorized access without credentials, while the emergence of EvilTokens phishing toolkit undermines multi-factor authentication. These developments highlight growing risks for web hosting users and organizations relying on MFA.
GLOBAL, May 4, 2026, 07:01 UTC
A critical security flaw discovered in cPanel and WebHost Manager (WHM) enables attackers to bypass authentication and access control panels without credentials, according to a recent advisory. This vulnerability affects nearly all versions of the software, widely used by web hosting providers.
The flaw's exploitation could allow attackers to take full control of hosting accounts, potentially leading to website defacement, data theft, or deployment of malicious code. Given cPanel's prevalence, the risk extends to thousands of organizations and individuals relying on these platforms for website management.
Simultaneously, cybersecurity researchers have identified a new phishing-as-a-service toolkit named EvilTokens, which surfaced in mid-February 2026. EvilTokens leverages social engineering tactics to circumvent multi-factor authentication (MFA), traditionally considered a robust defense against account compromise.
EvilTokens challenges the assumption that MFA alone can prevent unauthorized access, demonstrating that sophisticated phishing campaigns can still trick users into revealing session tokens or one-time passwords. This development signals a shift in attacker strategies, emphasizing the need for layered security measures beyond MFA.
The convergence of these threats underscores a critical moment for cybersecurity in web hosting and account protection. Users of cPanel and WHM are urged to apply patches and updates immediately to close the authentication bypass vulnerability.
Hosting providers should prioritize monitoring for unusual access patterns and consider implementing additional safeguards such as IP whitelisting and anomaly detection to mitigate exploitation risks.
For organizations relying on MFA, awareness campaigns and enhanced phishing resistance training are recommended to reduce the risk posed by tools like EvilTokens.
These incidents also highlight the importance of continuous threat intelligence and rapid response capabilities as attackers evolve their methods.
While patches for the cPanel vulnerability are being distributed, the window for exploitation remains open, posing a high risk to unpatched systems.
The effectiveness of MFA will depend increasingly on user vigilance and supplementary security controls, given the rise of phishing techniques targeting token interception.
Security teams should reassess their authentication frameworks and incident response plans in light of these emerging threats.
Red Hot Cyber, a cybersecurity news outlet, has been tracking these developments and providing detailed analysis on their platform.
The evolving landscape demands that both individual users and enterprises stay informed and proactive to defend against sophisticated cyberattacks exploiting software flaws and social engineering.
Source: https://www.redhotcyber.com/
Sources used for this article
redhotcyber.com
