Loading story…
CERT Polska published a warning about CVE-2026-6847, an unauthenticated remote code execution vulnerability affecting 4real ThemisNETPanel software. The issue was highlighted in a follow-on security report that identified the flaw as the primary risk, indicating that an attacker could potentially execute code on exposed systems without logging in.
Publicly available details remain limited in the referenced notices, with no affected version list, exploitation evidence, or vendor remediation steps included in the supplied material. Even so, the disclosure elevates risk for organizations using ThemisNETPanel because unauthenticated RCE flaws can enable full system compromise, making rapid asset identification and vendor update tracking a priority.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published a notice about an unauthenticated remote code execution vulnerability in 4real ThemisNETPanel software, tracked as CVE-2026-6847. The supplied references do not provide further technical details, affected versions, or remediation guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CyberPanel 2.3.6 contained an unauthenticated, zero-click remote code-execution flaw in the `/dataBases/upgrademysqlstatus` endpoint. A user-controlled `statusfile` parameter was concatenated into `sudo cat` and `sudo rm -f` commands, allowing an unauthenticated attacker to execute commands with root privileges. CyberPanel's `secMiddleware` attempted to block malicious POST input, but the endpoint processed request bodies regardless of HTTP method; attackers could use methods such as PUT to bypass the filter. Maintainers were notified and published a patch commit, and the issues were assigned **CVE-2024-51567** and **CVE-2024-51568**. The disclosure also noted a separate prior 2.3.5 File Manager upload weakness in which exception handling could bypass authentication and reach a command-execution sink.
Sep 3, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Aug 15, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026