cPanel auth bypass exploited in the wild, impacting all Linux distros since 2017

Businesses that host websites on Linux servers are facing a new, active threat. A vulnerability known as Copy Fail that disables authentication in cPanel is being exploited in the wild, and it affects every Linux distribution released since 2017.

The flaw allows an attacker to bypass the login screen that protects cPanel, the control panel used by most shared‑hosting providers to manage domains, email and databases. Once past the login, the attacker gains the same privileges as a legitimate administrator, the ability to read, modify or delete any file on the server.

Why does this matter now? The vulnerability was disclosed publicly earlier this year, and threat actors have already begun weaponising it. Reports confirm that the exploit has been used to steal the entire health‑care database of Moldova, exposing the personal records of every citizen. In a separate development, law‑enforcement raids on scam‑operating compounds in Dubai were linked to activity traced back to the same cPanel bypass.

Scope of the problem

• All Linux distributions released from 2017 onward are vulnerable. The issue is not limited to a single flavour such as Ubuntu or CentOS; any server running a supported kernel version can be compromised.
• cPanel installations that have not applied the latest security patches are exposed. The vendor released an update in March 2026, but many hosted environments remain on older builds.
• Active exploitation is confirmed by multiple independent security researchers who have observed the exploit in live traffic.

Real‑world impact

The Moldovan health‑care breach illustrates the scale of damage possible. Every citizen’s medical record, name, address, diagnosis and treatment history, was reportedly accessed. While the exact volume of data exfiltrated is still being assessed, the incident underscores how a single server compromise can cascade into a national‑level privacy disaster.

In Dubai, coordinated raids on facilities suspected of running large‑scale scam operations were reportedly triggered by investigations that traced malicious traffic to servers compromised via the same cPanel bypass. The number of compounds raided has not been disclosed, but the link suggests that the exploit is being leveraged to support organised fraud networks.

What you should do now

1. Verify your cPanel version, check the dashboard for the latest release number. If you are running a version older than the March 2026 patch, schedule an immediate upgrade.
2. Apply security patches, the vendor’s advisory provides a step‑by‑step guide. Ensure that the patch is applied to every server in your fleet, including staging and test environments.
3. Review access logs, look for unusual login attempts, especially from IP ranges that do not belong to your usual client base. Successful logins without a password prompt are a red flag.
4. Enforce multi‑factor authentication (MFA), while the vulnerability bypasses the password check, MFA adds an additional layer that can block unauthorised sessions.
5. Isolate critical services, consider moving high‑value applications to separate servers that do not run cPanel, or use containerised workloads that limit the blast radius of a breach.
6. Update incident response plans, incorporate the possibility of a cPanel compromise and rehearse steps for data‑exfiltration detection and containment.

Going forward

The Copy Fail vulnerability is a reminder that even widely‑used, mature software can harbour critical flaws. Regular patch management, continuous monitoring and defence‑in‑depth remain the most effective ways to mitigate risk. Keep an eye on the vendor’s security advisories and subscribe to threat‑intel feeds that track exploitation trends for cPanel and related components.

Terms used in this article

• cPanel, a web‑hosting control panel that lets administrators manage websites, email accounts and databases through a graphical interface.
• Linux distribution, a version of the Linux operating system packaged with specific software, such as Ubuntu, CentOS or Debian.
• Authentication bypass, a technique that allows an attacker to gain access without providing valid credentials.
• Exploit, code or a method that takes advantage of a software vulnerability to achieve unauthorised actions.
• Multi‑factor authentication (MFA), a security measure that requires two or more verification methods before granting access.

Stay vigilant, apply the patches, and monitor your environments closely. The window for attackers to abuse this flaw is closing, but only if you act now.

Keeping exposed control panels like this patched before an advisory turns into an incident is exactly the kind of recurring work handled under managed IT services.