Eric Sauvageau

IT consultant and computer psychiatrist. Asuswrt-Merlin lead developer.

[Eric Sauvageau @RMerlinDev]

@JayzTwoCents At 6'4" you should at least be able to see over the crowd. :)

[Eric Sauvageau @RMerlinDev]

@teo_tsirpanis @Itsfoss Also, I haven't looked at it in details, but it wouldn't surprise me if SOC-2 compliance might make it hard or impossible to use an ACME client.

[Eric Sauvageau @RMerlinDev]

@teo_tsirpanis @Itsfoss As I said, government and ecommerce, large corporations. They often include financial insurance on top of everything.

These types of certificates (I also forgot to mention OV) are for specific types of customers. Might not be you or me, but there are still customers for it.

[Eric Sauvageau @RMerlinDev]

After a few URL switches, the dnsmasq author now decided to put a "roadblock" in front of the git repo specifically for AI scraper bots. The FOSS community is visibly getting tired of the abuse from these AI providers.

I have Cloudflare rejecting AI scrapers as well now.

[Eric Sauvageau @RMerlinDev]

@ronniepapa3 @_JordanDecker None of these language warriors would be brave enough to tell that to his face, let's be honest :)

As for Saku... He already learned a second language (English). How many more to please EVERYBODY?

[Eric Sauvageau @RMerlinDev]

@Diss0lution For many years now, the Office 365 installer is broken in French, instead of showing something like "90% complété" in the system notification icon, it says "90lformat error! complété" - incorrectly parsing the percent sign as a parameter. Trillon dollars company at work.

[Eric Sauvageau @RMerlinDev]

@Love2Code I can get HD audio on a few very select calls, typically on my cell - it depends who I am calling from it.

While my VoIP provider does support HD codecs, the remote end virtually never supports it, so they revert back to old PSTN AM radio quality.

[Eric Sauvageau @RMerlinDev]

Two weeks later, @Google might finally be fixing the broken Gmail Android app?

https://t.co/piiG7snEOR

The bigger they are, the slower they are at fixing critical issues in their software. Users should expect better.

[Eric Sauvageau @RMerlinDev]

Dark mode is coming to the GT-BE19000AI dashboard.

[Eric Sauvageau @RMerlinDev]

@thurrott I know the site you are referring to, and I fully agree. Their article titling has been absolute garbage for a few years now. Which is a shame, I have been following that website for 15+ years now. Increasingly debating stopping to follow them at this stage.

[Eric Sauvageau @RMerlinDev]

@davidtranjs @QuinnyPig @Cloudflare A 2FA stored in a password manager is no longer a 2FA. Compromising that 1password account gives the hacker all the necessary keys to your kingom.

2FA does not belong in a password manager (unless it's a separate one).

[Eric Sauvageau @RMerlinDev]

@jrk_811 In Entra ID (Identity on the Admin portal), on the Properties tab of that page:

https://t.co/b2tEc4Bn9r

[Eric Sauvageau @RMerlinDev]

I finally found a solution to #Sharepoint #Onedrive sync folder using the org name for the local folder (problematic with extremely long org names). You can no longer rename the org under Org Settings. But you can rename it within Entra ID. That gets used for the folder name.

[Eric Sauvageau @RMerlinDev]

@yukizokin I've done some 80HC196 (Intel microcontroller) in college, in addition to 6809 and 68000. Intel ASM looked so stupid compared to Motorola, yet here we are today with Motorola CPUs being dead.

[Eric Sauvageau @RMerlinDev]

Why isn't this documented anywhere? I spent hours doing online searches, they all say "Sorry, can't be done anymore."

[Eric Sauvageau @RMerlinDev]

@catlikecoding My hoster for https://t.co/uSAYm7iWMl pre-emptively blocked WHM access right after the reveal, until the patch got published and deployed on their servers. Many providers with slack update practices are going to get owned.

[Eric Sauvageau @RMerlinDev]

@vxunderground cPanel released a script that reveals exploit attempts (and whether they succeeded). In two days I got 83 attempts on my business server, and a bit over 50 on a customer's own server. Thankfully we both got patched quite early.

This has the potential to compromise MANY sites.

[Eric Sauvageau @RMerlinDev]

What a week for security. Bitwarden supply chain compromise, Linux kernel LPE, cPanel password bypass, SNBForums and Linksysinfo flooded by (AI) bots, Ubuntu website also being DDoSed today... The Internet is a complete mess at this stage.

[Eric Sauvageau @RMerlinDev]

I checked my business server today. Since I patched two days ago, 83 attempts were made to exploit this.
Thankfully, most servers should be set to automatically update themselves. If you run an EOL version or you disabled auto updates... you're boned.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.