Connect with us

News

Hackers are actively exploiting a bug in cPanel, used by millions of websites

info

Published

on

Cpanel security flaw bug.jpeg

Security researchers are sounding the alarm on a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM). 

The bug allows hackers to hijack and take full control of the servers running the affected software, which is thought to be used by tens of millions of website owners around the world.

Many commercial web hosting companies have patched their customers’ systems already. But the cPanel maker urged customers to ensure that their systems are patched as the bug affects all supported versions of the software.

cPanel and WHM are two software suites used for managing web servers that host websites, manage emails, and handle important configurations and databases needed to maintain an internet domain. The two suites have deep-access to the servers that they manage, allowing a malicious hacker potentially unrestricted access to data managed by the affected software.

The bug, officially tracked as CVE-2026-41940, allows malicious hackers to remotely bypass its login screen to gain full access to the software’s administration panel. 

Given the ubiquity of the cPanel and WHM software across the web hosting industry, hackers could compromise potentially large numbers of websites that haven’t patched the bug.

Canada’s national cybersecurity agency said in an advisory that the bug could be exploited to compromise websites on shared hosting servers, such as large web hosting companies.

The agency said that “exploitation is highly probable” and that immediate action from cPanel customers, or their web hosts, is necessary to prevent malicious access.

Web hosting giant Namecheap, which uses cPanel to allow its customers to manage their web servers, said the company blocked access to customers’ cPanel panels after learning of the flaw to prevent exploitation, and to give it time to patch its customers’ systems

Hostgator also said it patched its systems and is considering the bug a “critical authentication-bypass exploit.”

One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.

KnownHost CEO Daniel Pearson said in a post on Reddit that his company has seen attempts to exploit the vulnerability as far back as February 23. The company said it also briefly began blocking access to customer systems before applying patches.

According to Pearson, around 30 servers at KnownHost showed signs of unauthorized attempted access out of thousands of computers on its network. Pearson likened the efforts to attempts, and has not seen signs of active compromise. cPanel also said it rolled out a security fix for WP Squared, a similar tool for managing WordPress websites.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

News

NPFL: Plateau United vs Kano Pillars to play behind closed doors 

info

Published

on

By

20221102 181736.jpg

Plateau United has announced that their Nigeria Premier Football League (NPFL) Matchday 38 fixture against Kano Pillars will be played behind closed doors.

The Peace Boys made the announcement in a statement on Friday.

Plateau United stated that the decision was reached due to security reasons.

Gbenga Ogunbote’s side will lock horns with Kano Pillars at the New Jos Stadium on Sunday.

Plateau United need a win in the game to secure their top-flight status, while Kano Pillars must avoid defeat to escape relegation.

Kano Pillars sit in 10th position on the NPFL table with 48 points, while Plateau United are 12th with 47 points.

Bayelsa United and Wikki Tourists have already been relegated to the second tier, with two more teams set to join them.

Continue Reading

Business

NNPC accuses Dangote refinery of seeking fuel monopoly in court filing

info

Published

on

By

WhatsApp Image 2023 11 14 at 7.08.40 AM e1761856902627.jpeg

The Nigerian National Petroleum Company Limited (NNPC Ltd) has accused Dangote Petroleum Refinery of attempting to monopolise Nigeria’s fuel market through a lawsuit challenging import licences granted to rival marketers.

In court documents, the state oil company argued that granting Dangote’s request to void or restrict fuel import permits would undermine competition and expose Nigeria to supply disruptions, price instability and threats to national energy security.

The position was contained in a proposed defence filed before the Federal High Court in Lagos in response to a suit instituted by Dangote Petroleum Refinery against the Attorney-General of the Federation.

Reuters reported that the legal dispute has resulted in the Nigerian Midstream and Downstream Petroleum Regulatory Authority (NMDPRA) applying to join the case.

The move comes less than a month after Dangote Petroleum Refinery filed a fresh lawsuit against Nigeria’s Attorney-General, seeking to overturn fuel import licences granted to oil marketers and the NNPC.

PT WHATSAPP CHANNEL

The lawsuit exchange has also broadened the battle over Nigeria’s fuel import policy and the market influence of Dangote’s 650,000 barrels-per-day refinery.

The dispute comes ahead of Dangote Refinery’s planned initial public offering (IPO) in September, raising fresh concerns over market regulation, competition, and the refinery’s future revenue outlook.

In its lawsuit against the government, the refinery argued that licences issued to rival marketers undermine local refining efforts and violate provisions of the Petroleum Industry Act (PIA), which it said was designed to encourage domestic refining capacity.

However, NNPC has rejected the claim, arguing that the law permits the issuance of import licences to companies with local refining licences or established records in international crude oil and petroleum products trading.

The state oil company further argued that regulators retain the discretion to manage fuel imports under Nigeria’s backward integration policy and that there is no outright ban on fuel imports except where local production sufficiently meets domestic demand.

According to the court documents, NNPC also contended that Dangote refinery had failed to provide “credible, independent or verifiable evidence” that it could consistently meet Nigeria’s total fuel demand and guarantee uninterrupted nationwide supply.

Dangote refinery declined to comment on the matter, citing the ongoing court proceedings.

NNPC also denied allegations that it deliberately frustrated Dangote refinery’s operations or withheld crude oil supplies from the facility.

The company said crude oil allocations were determined by operational, commercial, security and logistical considerations.

Fuel marketers have equally opposed Dangote’s suit, warning that restricting import licences could weaken market competition and threaten fuel supply stability across the country.

The court is expected to hear the matter in the coming weeks.

Background

Since commencing operations in 2024, Dangote Refinery has repeatedly pushed for local marketers to source petroleum products primarily from domestic refineries rather than continue importing refined fuel.

However, the former NMDPRA leadership under Farouk Ahmed consistently resisted any move perceived as creating a monopoly, insisting that allowing a single refinery to dominate supply would undermine competition and threaten Nigeria’s long-term energy security.

That disagreement led to a feud between Aliko Dangote and Mr Ahmed.

Mr Dangote later accused Mr Ahmed of corruption and alleged that the regulator was colluding with international traders and fuel importers to frustrate local refining by continuing to issue import licences.

He also alleged that Mr Ahmed was living beyond his legitimate means, claiming that four of his children were enrolled in expensive secondary schools in Switzerland, raising concerns over possible abuse of office and regulatory integrity.

Mr Ahmed later resigned following the controversy.

Previous lawsuit

In 2024, Dangote Refinery, in suit number FHC/ABJ/CS/1324/2024, asked the court to award N100 billion in damages against the NMDPRA for issuing import licences to some marketers and permitting the importation of petroleum products.

The marketers listed in the suit were NNPC Ltd, Matrix Petroleum Services Limited, AYM Shafa Limited, A.A. Rano Limited, T. Time Petroleum Limited, and 2015 Petroleum Limited.

In the suit dated 6 September 2024, the plaintiff’s lawyer, Ogwu Onoja, asked the court to declare that the NMDPRA violated Sections 317(8) and (9) of the Petroleum Industry Act (PIA) by issuing licences for the importation of petroleum products.

Dangote Refinery argued that such licences should only be issued when a petroleum product shortfall exists.

The refinery also asked the court to declare that the NMDPRA failed in its statutory responsibility under the PIA by failing to encourage local refineries, such as Dangote Refinery.

However, in a counter-affidavit marked FHC/ABJ/CS/1324/2024 dated 5 November 2024 and filed by Ahmed Raji (SAN), the marketers asked the court to dismiss Dangote Refinery’s claims, insisting that competitive practices are essential to Nigeria’s economic health and the viability of the oil sector.

They argued that they were fully qualified to receive import licences from the NMDPRA under Section 317(9) of the PIA.

The defendants further alleged that the plaintiff was attempting to monopolise Nigeria’s petroleum industry by seeking sole control of supply, distribution, and pricing.

In July 2025, Dangote Refinery quietly discontinued the lawsuit challenging the import approvals without publicly stating its reasons, leaving unresolved concerns over market competition and supply dynamics in one of Africa’s largest fuel markets.

READ ALSO: NNPC posts N276 billion profit in March

For decades, Nigeria has relied heavily on imported petrol because its state-owned refineries have performed poorly.

The $20 billion Dangote Refinery, owned by billionaire businessman Aliko Dangote, was expected to end that dependence by supplying refined petroleum products locally.

With an installed capacity of 650,000 barrels per day, the facility is Africa’s largest single-train refinery and is projected to reduce pressure on foreign exchange used for fuel imports significantly.

However, petrol imports have persisted as the refinery continues to ramp up production and distribution capacity, while marketers maintain that domestic output alone has yet to meet national demand fully.

Continue Reading

Trending