Hackers compromised accounts belonging to maintainers of the open-source ZPanel after a team member supporting the Web hosting control panel called a critic a "fucken little know it all." The ZPanel site went completely down after the incident and remained down at time of writing.
ZPanel support member Nigel Caldwell made the comment in the site's official forums and it was directed at a user named joepie91. Shortly beforehand, the Netherlands-based software developer—whose real name is Sven Slootweg—claimed that websites using ZPanel in combination with certain modules were vulnerable to exploits that allowed attackers to remotely execute malicious code. Slootweg directed his statement at Caldwell, aka PS2Guy, after the support member left a comment saying ZPanel "is more secure than panels that you pay good money for." Caldwell also said users have "got more chance of someone hacking your Operating System than the control panel that sits on it."
In his response, Slootweg claimed there was an "arbitrary code execution and root escalation vulnerability in the current version of ZPanel." To support this, Slootweg provided an example line of code he said could be inserted into a main ZPanel template to trigger the vulnerability. Last month, Slootweg disclosed a ZPanel vulnerability here. Two weeks ago, he stepped up his criticism after claiming the vulnerability had gone unfixed. "I find it shameful that I even have to post here to point this out, to prevent someone from putting themselves at risk," Slootweg wrote in Wednesday's post on the ZPanel forum. "This should be the responsibility of the ZPanel team."
Read 12 remaining paragraphs | Comments