Post by @himysyed

HiMY SYeD - littleFedi
@himysyed
Public en edited

This is a copy and paste from :

https://lowendtalk.com/discussion/comment/4893844/#Comment_4893844

( I wanted to keep a copy for my own reference in my timeline )
---------

PHP-based billing panels:

* WHMCS
* Blesta
* HostBill
* BillingServ
* ClientExec
* FOSSBilling

What hackers can do:

* leak customer data — GDPR lawsuits
* charge stored cards (although money goes to you) — chargebacks
* call hypervisor API (see below)

PHP-based hypervisor panels:

* SolusVM 1.x
* Virtualizor
* VirtFusion
* Tenantos
* Convoy

What hackers can do:

* delete VPS — angry tickets from and refunds for managed clients, drama threads from unmanaged clients
* create VPS — mine monero, send spam — your IP listed on Spamhaus
* do naughty inside the VPS (see below)

PHP-based shared hosting panels:

* Plesk
* ISPConfig
* Froxlor

What hackers can do:

* delete files, deface website, wipe databases — angry tickets from and refunds for managed clients, drama threads from unmanaged clients

These panels are not PHP based:

* Billing: BILLmanager (C++)
* Hypervisor: Proxmox VE (Perl), SolusIO (Go), OpenStack (Python)
* Shared hosting: cPanel (Perl), DirectAdmin (C++), aaPanel (Python)

You can escape PHP vulnerabilities, but they can have their own vulnerabilities.

Comment > Looks like Virtualizor/Softaculous shut down their websites.
virtualizor emps runs on php 7.4

| #php