WHMCS Breach May Be Only Tip of the Trouble
Summary: WHMCS, a billing and support software provider used mainly by Web hosting firms, disclosed that hackers stole 1.7 gigabytes of customer data and deleted orders and tickets from its server after impersonating founder Matt Pugh to its own Web hosting provider and obtaining administrative credentials. KrebsOnSecurity reported that for four months a verified member of an underground forum had been selling a WHMCS zero-day, described as a full blind SQL injection that extracts the admin hash and allows login by faking cookies, for $6,000 to a maximum of three buyers.
Key Takeaway: The breach exposed a half million customer usernames and passwords, and one user said the software stores its decryption key in its configuration file, so any billing gateway without tokenization would have credit card numbers in the MySQL database encrypted with that key.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026