Loading story…
WebPros cPanel disclosed and patched a critical authentication bypass flaw in cPanel & WHM and WP Squared, now tracked as CVE-2026-41940 with a CVSS 9.8 score. The bug affects all supported cPanel & WHM versions after 11.40 prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a CRLF injection in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart cpsrvd, and investigate session files and logs for signs of compromise.
Multiple sources reported the flaw was actively exploited in the wild before patches were issued, with hosting providers such as Namecheap and KnownHost taking emergency action by restricting access to management ports like 2083 and 2087 while deploying fixes. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
See which actors are running it and whether you're in range.
15 events from the most recent confirmed update back to the earliest known activity.
cPanel published additional security advisories addressing vulnerabilities in cPanel & WHM and WP Squared, covering versions prior to several newer fixed releases. Canada's Cyber Centre relayed the advisory and urged users to apply updates.
A weaponized proof-of-concept framework named cPanelSniper was released on GitHub for CVE-2026-41940. The tool automated exploitation steps for forging a root WHM session and supported bulk scanning and post-exploitation actions.
News reporting on May 1 said CISA ordered U.S. federal agencies to patch the cPanel bug by Sunday, May 3, after confirming active exploitation. The reporting also noted multiple hosting providers had taken emergency defensive actions.
Cato Networks reported observing exploitation attempts for CVE-2026-41940 in the wild and released IPS signatures for virtual patching. It also shared network indicators associated with attacker infrastructure.
cPanel released a detection script and guidance to help administrators inspect session files and investigate possible compromise after patching. Reporting also noted advice to restart cpsrvd and block management ports if immediate patching was not possible.
Under Binding Operational Directive 22-01, CISA required Federal Civilian Executive Branch agencies to remediate CVE-2026-41940 by May 3, 2026. CISA also urged broader prioritization of remediation by all organizations.
CISA assessed CVE-2026-41940 as actively exploited and recorded known use of the cPanel/WHM authentication-bypass flaw in ransomware campaigns. CISA characterized exploitation as automatable and capable of total technical impact.
CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. The KEV entry covered WebPros cPanel & WHM and WP2/WP Squared.
The Canadian Centre for Cyber Security issued Alert AL26-008 warning that CVE-2026-41940 was a critical missing-authentication flaw in cPanel and WHM. The alert urged immediate patching, access restrictions, and log review due to highly probable exploitation.
watchTowr Labs publicly released technical details and a proof-of-concept exploit for CVE-2026-41940, explaining the CRLF injection and session manipulation path to administrator access. Multiple sources noted this increased the likelihood of broader exploitation.
The authentication bypass vulnerability received the identifier CVE-2026-41940 and was described as a critical issue with a CVSS score of 9.8. Subsequent reporting tied the bug to missing authentication and session-handling flaws in cPanel & WHM.
Namecheap implemented emergency mitigations by blocking access to cPanel and WHM-related ports, including 2083 and 2087, until patches could be deployed. The provider later reported patch rollout across affected hosting services.
cPanel disclosed a critical authentication bypass vulnerability affecting supported cPanel & WHM releases and published patched builds across supported branches. Advisories also referenced impact to WP Squared and urged administrators to update immediately.
KnownHost reported seeing exploitation attempts targeting the cPanel/WHM authentication bypass as early as February 23, 2026, indicating likely zero-day abuse before public disclosure. Some reports said about 30 servers saw unauthorized access attempts.
SL Cyber described a non-destructive detection approach for CVE-2026-41940 that tests session injection with randomized usernames and an expired-session marker. The methodology also warns that blocked management ports may not prevent reachability through Apache proxy paths such as /___proxy_subdomain_whm/ and /___proxy_subdomain_cpanel/.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
50 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourcevulnerability.circl.lu
Open sourcecyber.gc.ca
Open sourceccb.belgium.be
Open sourcebleepingcomputer.com
Open sourcerapid7.com
Open sourcerunzero.com
Open sourcenamecheap.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
cPanel disclosed and patched a critical authentication bypass in cPanel & WHM, tracked as **`CVE-2026-41940`**, after reports of active in-the-wild exploitation against hosting infrastructure. The flaw affects authentication paths in supported versions and can let unauthenticated attackers reach administrative interfaces, forge authenticated sessions, and potentially gain control of hosted websites, databases, email accounts, and server configuration. Government and industry alerts warned that shared hosting environments face outsized risk because a single compromised server can expose many downstream customer sites, and some providers temporarily restricted cPanel and WHM login ports while applying fixes. Public technical analysis and a GitHub proof-of-concept described an exploit chain involving manipulated HTTP headers and session cookie handling to create forged privileged sessions, including possible root-level WHM access. Separately, cPanel also patched three additional vulnerabilities in cPanel & WHM and **WP Squared**—**`CVE-2026-29201`**, **`CVE-2026-29202`**, and **`CVE-2026-29203`**—that enable arbitrary file read through path traversal, Perl code injection leading to remote code execution, and denial-of-service via unsafe symlink handling. The most severe of the newly disclosed flaws, **`CVE-2026-29202`**, affects the `create_user` API and can allow arbitrary Perl code execution on the server, reinforcing calls for immediate upgrades, restricted access to management interfaces, and log review for suspicious authorization and cookie activity.
Jun 29, 2026
A critical authentication bypass flaw, tracked as **`CVE-2026-41940`**, affects **cPanel & WHM** and **WP Squared** deployments and has been publicly reported as under active exploitation. The vulnerability can let unauthenticated remote attackers bypass normal login controls in certain conditions and potentially obtain administrative access to internet-facing hosting systems that manage websites, databases, email, DNS, SSL certificates, and customer accounts. Guidance tied to the disclosure urges organizations to apply vendor-patched builds immediately and investigate for signs of compromise, as a successful breach could expose downstream environments and sensitive business data. Recommended response actions include isolating affected servers, rotating credentials, removing attacker persistence, and rebuilding compromised systems, alongside longer-term hardening such as **MFA**, network segmentation, reduced internet exposure, tighter privileged access, and continuous vulnerability monitoring.
Jun 29, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Aug 15, 2026