Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Fake Security Advisory Used In Clever cPanel Phishing Attack

Fake Security Advisory Used In Clever cPanel Phishing Attack


A clever phishing scam is targeting cPanel users with a fake security advisory alerting them of critical vulnerabilities in their web hosting management panel. 

cPanel is administrative software commonly installed on shared web hosting services that allow website owners to easily administer their site through a graphical user interface.

Starting on Wednesday, cPanel and WebHost Manager (WHM) users began reporting a targeted phishing email campaign with an email subject of “cPanel Urgent Update Request” that was pretending to be a security advisory from the company.

This fake advisory stated that updates had been released to fix “security concerns” in cPanel and WHM software versions 88.0.3+, 86.0.21+, and 78.0.49+, and recommends all users install the updates.

cPanel Urgent Update Notification

cPanel has released new builds for all public update tiers. 

These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system. 

cPanel has rated these updates as having CVSSv3 scores ranging from 3.3 to 9.9. 

Information on cPanel’s security ratings is available at 

We strongly encourage you to update your cPanel & WHM installations at your earliest convenience. 
Update your cPanel & WHM installations 


The following cPanel & WHM versions address all known vulnerabilities: 

88.0.3 & Greater 
86.0.21 & Greater 
78.0.49 & Greater 


The cPanel Security Team identified the resolved security issues. There is no reason to believe that these vulnerabilities have been made known to the public. As such, cPanel will only release limited information about the vulnerabilities at this time. 

Once sufficient time has passed, allowing cPanel & WHM systems to automatically update to the new versions, cPanel will release additional information about the nature of the security issues. This Targeted Security Release addresses 10 vulnerabilities in cPanel & WHM software versions 88, 86, and 78. 

For information on cPanel & WHM Versions and the Release Process, read our documentation at: 

cPanel Team 

Unlike many phishing scams seen by BleepingComputer, the attackers in this campaign took time and effort to construct a convincing attack.

In addition to a well-worded email with little or no grammar and spelling issues, the threat actors used language commonly found in security advisories.

The attackers registered the domain ‘’ to make the scam appear as an authentic advisory from cPanel and are using Amazon Simple Email Service (SES) to send out the emails.

Fake security advisory from cPanel
A fake security advisory from cPanel

If a recipient of this phishing email falls for the scam and clicks on the ‘Update your cPanel & WHM installations’, they were brought to a website that prompted a user to log in with their cPanel credentials.

At this time, the phishing landing page is currently down and redirects to a Google search for the keyword ‘cpanel.’

As this is a well-done and convincing scam, it would not be surprising if some users fell for the scam.

If you received a similar email recently and entered your login credentials at the site, it is strongly suggested that you immediately log in to your web hosting provider and change the password on your account.

You should then perform a complete audit of your site while paying extra protection to the addition of strange PHP files that can be used as backdoors. Also, be sure to examine the website’s .htaccess file for changes that automatically inject malicious code into every web page or redirect visitors.

Thx to dokadtuptajez for the tip.




Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us