the CP CEO

Building a panel for hosting providers & agencies for the next decade

[the CP CEO @jvrpl]

Yesterday I came back home from #WCEU. Opinions from the WordPress community directly — it’s going great, everything will be fine.
Opinions from the #webhosting community — WordPress will always stay strong, but it looks like it’ll end up like internet forums.

[the CP CEO @jvrpl]

@jdevalk Congrats!

[the CP CEO @jvrpl]

We shipped this in adminbolt 1.0.2 alongside: — Native WordPress module with SSO and async installer — Broad security hardening (phpMyAdmin, FTP, cron, backups, DNS) — Symlock per-account symlink protection Release notes:

https://t.co/boc8RKQc4o

[the CP CEO @jvrpl]

We just shipped the first hosting control panel you can manage entirely via WhatsApp. Pair your number once. Ask "add domain https://t.co/QzpibFpBp3 with PHP 8.4." Done. Here's what it does and why it matters for operators outside the US. 🧵

[the CP CEO @jvrpl]

We shipped this in adminbolt 1.0.2 alongside: — Native WordPress module with SSO and async installer — Broad security hardening (phpMyAdmin, FTP, cron, backups, DNS) — Symlock per-account symlink protection

[the CP CEO @jvrpl]

Why WhatsApp specifically? Most hosting work is reactive. Customer calls, alert fires, deal closes. None of that happens while sitting in front of the panel. Outside the US, WhatsApp is the default business channel. We met operators where they already are.

[the CP CEO @jvrpl]

The diagnose category is where the LLM earns its keep. A keyword search through 50MB of access logs won't tell you the pattern. The assistant pattern-matches across lines, summarizes, recommends the next check. That's a support-engineer-level task you can now run from a phone

[the CP CEO @jvrpl]

Connect WhatsApp from the same dashboard. 30-second pairing flow. Session duration: 1 day / 7 days / 30 days / never expire. Confirmation word for destructive ops, stored at the Agent Hub, not the panel.

[the CP CEO @jvrpl]

The AI Assistant lives in the panel dashboard. Type plain English, get structured responses. "show me websites" returns a table — not a paragraph. Domain, ID, PHP version, status. Sortable, copyable, current.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[the CP CEO @jvrpl]

@maietta @TrasherDK Take a look: https://t.co/pxTD8Q94Xd

[the CP CEO @jvrpl]

Great take from @racknerd on the control panel market. We encourage you to watch https://t.co/jrduiTTfM5

[the CP CEO @jvrpl]

@jdevalk @anildash The people who built the open web's best tools spent 15 years optimizing content for Google. Now Google uses that content to answer questions without the click. We trained our own replacement.

[the CP CEO @jvrpl]

Your hosting panel is consuming memory your clients' sites could be using.

Traditional panels: ~920MB just to run.
adminbolt: ~380MB.

60% less overhead per server. More headroom for actual workloads.

https://t.co/xY4Su3OB99

[the CP CEO @jvrpl]

With per-account pricing, every new client makes your overhead higher.

At 30 accounts: $53.99/mo in licensing.
At 500 accounts: ~$270/mo. Same server. Same hardware.

adminbolt: $20/mo — 30 accounts or 500, same price.

https://t.co/xY4Su3OB99

[the CP CEO @jvrpl]

@SomethingSubtle @ritakozlov I think that we just did that ;) take a look: https://t.co/pxTD8Q94Xd

[the CP CEO @jvrpl]

adminbolt is now available as a control panel option on @Hostinger .
If you're spinning up a VPS, you'll see us in the list.

This is what it looks like when independent software starts showing up where it matters. More to come.

https://t.co/xY4Su3OB99

[the CP CEO @jvrpl]

Another price increase?
This week’s calls with hosting providers made one thing clear:

Nobody’s surprised – but everyone’s tired.
We're building adminbolt so you don't have to keep adjusting your plans to someone else’s pricing roadmap.

#webhosting #controlpanel

[the CP CEO @jvrpl]

@Cloudflare I'm building a new hosting control panel — a real alternative to cPanel / DirectAdmin.

We're planning to integrate with Cloudflare, but before we go too far...

– What would you expect from that integration?
– What’s missing today?
– What should “just work” by default?

[the CP CEO @jvrpl]

A hosting panel shouldn’t be a dashboard.
It should be a growth layer.

- Ownable
- Brandable
- Extendable
- Built for real-world workflows

You don’t need “features.”
You need leverage.

#hosting #WordPress