-
Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)
Sep 19, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Custom Query (KQL) Vuln: CVE-2026-41940 ·Identifies the network signature of CVE-2026-41940, a pre-auth root-level authentication bypass in cPanel and WebHost Manager (WHM) caused by a CRLF injection in the session writer. The exploit-inherent shape on the wire is a "GET /" request to a cPanel/WHM admin port (typically TCP/2087, 2086, 2083, 2082, 2095, 2096) carrying an "Authorization: Basic" header whose base64-decoded value contains CRLF-injected session fields, which causes cpsrvd to respond with a 3xx redirect whose "Location" header leaks a "/cpsessNNNNNNNNNN" token granting the attacker a privileged session. This is the network-layer equivalent of the cPanel "access_log" artifact identified by Unfold and watchTowr as the first bulletproof detection for this CVE: a "GET /" recorded with "auth_method=b" (HTTP Basic). Legitimate access to "GET /" on a WHM admin port returns 200 with the login screen and never includes HTTP Basic credentials, so this combination is not produced by normal use.
Read More -
React2Shell (CVE-2025-55182) Exploitation Attempt
Sep 19, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Vuln: CVE-2025-55182 Threat: React2Shell ·This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor. This rule focuses on high-fidelity indicators of active exploitation including successful command execution responses and prototype pollution attack patterns.
Read More -
React2Shell Network Security Alert
Sep 19, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: PAN-OS Data Source: Fortinet Data Source: Suricata Data Source: Cisco FTD Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Custom Query (KQL) Vuln: CVE-2025-55182 Threat: React2Shell ·This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.
Read More