I Found an Exposed cPanel Instance on a Startup. Then This CVE Dropped

A few months back I was doing passive recon on a fintech startup as part of some responsible disclosure research. Nothing crazy — subdomain enumeration, checking for exposed admin panels, the usual. O