What's the security situation with cpanel?

[DmC]

[wolstech]

You're correct, we generally don't install the updates for cP. cPanel's updates are primarily feature enhancements anyway, so there's little in the way of issues there. The major things that need updates are PHP, Python, Apache, Tomcat, etc. and those do get updated when possible.

 

Our other big issue is obsolescence. Our custom software is one major reason, but the ancient hardware is another one. The software coming out these days isn't designed for hardware from the mid-2000s. Our oldest server is ~13 years old (Stevie/Ricky), and our youngest is going on 8 (Eddie/Tommy). Software today is optimized for hardware made in the past few years...

 

As our hardware ages, they become less and less capable of running the newer versions of cPanel that weren't designed for them. Take Ricky for example...he used to be blazing fast with a significant number of accounts back when he had 11.31 on him. After he was rebuilt due to disk failure, we were forced to upgrade him to one of the 6x versions (cPanel does not allow you to install old releases). Now we get significantly fewer accounts on that server before it becomes slow enough to be unusable, which further lowers our revenue from ads shown to users.

 

We do have a slightly newer server (Katie), but it's not advertised because it only contains VPSes (at the moment Ashoat and I share it). The VPSes can be purchased if you wanted your own OS to run whatever software you want: https://heliohost.org/vps (I believe at the moment these go on Eddie, Tommy's hardware, but Katie is I believe also intended for this use).

Edited January 9, 2019 by wolstech
Forgot about Katie