[chirpy]

Originally Posted by jack01

I am still confused about one thing though. How are the hackers this time around getting the list of username/passwords even on cpanel servers that have automatic security updates enabled in the WHM 'Update Config' settings? Should the whole version of cpanel and not just the security patches have been updated to the latest to be safe?

Will you please stop cross-posting this on the forums. Stick to one thread.

If you believe that you were compromised through a cPanel related route you should contact cPanel and have them investigate before trying to patch things up. Do obviously make sure that you are running a supported and updated OS and kernel, though. Posting your cPanel, OS and kernel versions here would also help, together with which FTP daemon you are using.