Hackers have begun exploiting a critical remote code execution vulnerability in unpatched versions of the Control Web Panel, a widely used web hosting interface
Patch NOW Ionut Arghire / SecurityWeek : Exploitation of Control Web Panel Vulnerability Starts After PoC Publication TechRadar : Hackers target and exploit major Control Web Panel security flaw Msmash / Slashdot : Vulnerability With 9.8 Severity in Control Web Panel is Under Active Exploit Tweets: Chris Wysopal / @weldpond : Today's Example of the 20% of apps with a critical vuln “login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter” https://thehackernews.com/... Rob Joyce / @nsa_csdirector : Active exploitation of Centos Control Web Panel through CVE-2022-44877. Patch issued in Oct. Exploitation is picking up. Attackers can get elevated privileges and remote code execution, leading to dangerous exploitation. Close down this vulnerability. https://arstechnica.com/...
Context & Ripple Effects
Control Web Panel shipped a fix for the flaw back in October, but exploitation only began once a proof-of-concept appeared — the same sequence seen in vBulletin's 2019 mass exploitation, which also ignited after an exploit was published anonymously. The vulnerable code path is the login page itself: shell metacharacters in the login parameter hand attackers arbitrary OS commands on the host.
First-order effects
- Hosting providers and resellers still running CWP versions before 0.9.8.1147 have internet-facing servers that any attacker can commandeer without credentials, since the flaw sits on the pre-authentication login endpoint.
- Admins who patched in October are protected, making this a race between patch deployment and scanner-driven compromise rather than a zero-day emergency.
Second-order effects
- Every site and customer account hosted on an unpatched panel inherits the exposure, so small hosts become the supply chain into their clients' infrastructure.
- Rival panels come under the same lens: cPanel's own later 9.8-severity exploited bug, which drew a CISA patch deadline for agencies, shows the entire hosting-control-panel category is treated as high-value attack surface.
Third-order effects
- If the PoC-publication-to-mass-exploitation pattern holds — visible again in the unauthenticated Apache Tomcat RCE wave — vendors and regulators will keep shortening the expected patch window, pushing toward enforced deadlines like CISA's rather than advisory-only disclosure.
- Unauthenticated RCE in widely deployed management software is becoming the standard intrusion vector against shared hosting, shifting defense budgets toward edge hardening and rapid-patch automation.
The trend: Public proof-of-concept releases are collapsing the gap between disclosure and mass exploitation of hosting-control-panel flaws, turning patch latency into the primary determinant of who gets breached.