IT News: cPanel Zero-Day Lessons and AWS Continuum GA

Top story

The most-discussed IT security story today is a retrospective on a cPanel zero-day, CVE-2026-41940, an authentication bypass in the session-management layer of cPanel and WHM. According to a report published November 9, 2026, which cites a CrowdStrike analysis, exploitation began at least on April 3, 2026. cPanel disclosed the flaw and shipped fixes on April 28, so attackers had at least 25 days before a patch existed. Mass, opportunistic exploitation followed from April 30, once technical details were public.

The patch has now been available for more than six months, but servers left unpatched since April 28 should be treated as potentially compromised. The report recommends updating to a fixed build and confirming the installed version (check cPanel's advisory for the current build on your branch), purging sessions, resetting root and WHM passwords, auditing logs back to at least April 3, and hunting for persistence such as cron jobs and unknown SSH keys. It also notes that patching alone may not be enough.

Security and cloud

A report published November 7, 2026 covers AWS Continuum, a set of AWS security services for the whole software lifecycle that AWS introduced on June 17, 2026. Its code-vulnerability capability finds weaknesses in code, tests whether attackers could exploit them and generates fixes. It started in a gated preview that required approval, and it became generally available on October 22, 2026. This applies to code vulnerabilities only. Other parts of Continuum, such as threat modeling, are still in preview.

Pricing is pay-as-you-go and tiered: a monthly context fee of US$200 per million protected lines for the first 10 million lines (falling at higher volumes), plus US$10 per Continuum inference unit. The report lists no Australian Region and no local launch date, a gap that matters for companies with data residency requirements in that market.

Separately, SecurityBrief UK's cloud security coverage from late October includes two items. Coro expanded its Italian reach through a partnership with Activa Digital, giving small and mid-sized Italian firms another bundled cybersecurity option, and the coverage links this to tighter EU rules that are increasing demand for simpler security tools. Oracle also added AI networking upgrades to Acceleron, aimed at reducing bottlenecks and outages for customers running large AI workloads on Oracle Cloud Infrastructure.

Why this matters

These stories point to two themes in enterprise IT: the gap between when a vulnerability is first exploited and when a patch exists, and the steady expansion of cloud security tooling. The cPanel case is a reminder that a patch date does not mark the start of risk. Widely used, mature software can be exploited for weeks before a fix, and unpatched systems stay exposed long after it ships.

For IT administrators, the practical takeaway is straightforward: confirm that every cPanel and WHM installation runs a fixed build, search logs back to early April, keep an eye on when cloud security features move from gated preview to general availability (since that often changes pricing and access), and watch for regional gaps, like the missing Australian Region for AWS Continuum, that could affect deployment plans.

What to watch next

No specific upcoming dates were confirmed in the reporting. Worth monitoring are follow-up advisories on the cPanel exploitation and whether the remaining AWS Continuum components, such as threat modeling, move from preview to general availability.