hodlemperor ⚡️

₿itcoin. Hodler and Researcher. Focus on long term.

[Marcel Pociot 🧪 @marcelpociot]

If you are using laravel-lang/* packages, watch out!

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[Clément Dumas @Butanium_]

⚠️ Supply chain attack in progress: someone is squatting Anthropic-internal npm package names targeting people trying to compile the leaked Claude Code source.

`color-diff-napi` and `modifiers-napi` — both registered today, same person, disposable email. Do NOT install them. 🧵

[Arkad @Multicripto]

Do you know what your Bitcoin transactions reveal about you? https://t.co/y37tjfXoG8 shows you. It's an on-chain privacy scanner that analyzes addresses and transactions. 🧵

[hodlemperor ⚡️ @hodlemperor]

@LorenzoDavico @ultimoranet Se aspetti un giudice per avere un opinione personale sul fatto e la condanna che dovrebbe avere chi lo ha commesso hai decisamente problemi. Non ce molto da valutare qui

[hodlemperor ⚡️ @hodlemperor]

@Cinico_ La percezione del tempo è relativa alla durata della tua vita a 10 anni 5 anni sono metà della vita trascorsa.

[jack @jack]

bitchat?

now on the App Store: https://t.co/uzB0uqRJGy

[hodlemperor ⚡️ @hodlemperor]

@madddalena Vero troppa roba woke

[hodlemperor ⚡️ @hodlemperor]

@SouISeven @fanpage Chiarisco : Anche se sei disposto a pagare e accettare la stiva, NON hai la garanzia al 100% di essere imbarcato, se il controllo bagagli avviene troppo tardi nella fila e il tempo per le operazioni si esaurisce.

[hodlemperor ⚡️ @hodlemperor]

@SouISeven @fanpage Eh no se non l hai fatto in check in ma ti viene controllato in imbarco non è detto che fai in tempo

[hodlemperor ⚡️ @hodlemperor]

@gadlernertweet Le categorie rappresentate vanno bene solo per pubblicità progresso come il fare figli con donne italiane

[hodlemperor ⚡️ @hodlemperor]

@MadameA02 Chi fa questi commenti è sempre chi non ha figli. sempre

[Francesco 🇮🇹 @SaP011]

Non vogliono vivere nei loro Paesi.

Non sanno vivere nel nostro.

Ma il problema, secondo “qualcuno”, siamo noi.

[hodlemperor ⚡️ @hodlemperor]

@mammmmares @Reazione_Nova Anche quelle retoriche ? 🤭

[hodlemperor ⚡️ @hodlemperor]

@mammmmares @Reazione_Nova Perchè le altre etnie erano schiave ?

[hodlemperor ⚡️ @hodlemperor]

@Ginger_Eil Sceme

[hodlemperor ⚡️ @hodlemperor]

@nicola_humar SIETE,ANCORA ED OGGI COME SEMPRE DEI POVERI COMUNISTI

[hodlemperor ⚡️ @hodlemperor]

@mrk4m1 Assurdamente Motivo per cui non mi viene mai voglia di spiegare come funzionano i cold wallet e le strategie di opsec, più gente lo sa meno mi sento sicuro

[hodlemperor ⚡️ @hodlemperor]

@andreavianel Basta Nerghi grazie