Reported by 6 outlets

Timeline

1. original reporting

   cPanel/WHM critical authentication bypass (CVE-2026-41940, CVSS 9.8) requires emergency manual update

   bleepingcomputer.com · 168d ago · April 29th, 2026

   A critical authentication bypass vulnerability in cPanel and WHM allows unauthenticated access to the hosting control panel on all supported versions except the very latest. With a CVSS score of 9.8, this is among the highest-severity vulnerabilities disclosed this week — and the emergency patch is not delivered through normal update channels. Administrators must manually run /usr/local/cpanel/scripts/upcp to pull the fix, meaning organizations relying on automatic updates will remain vulnerable. The severity of the issue is underscored by Namecheap's decision to temporarily block ports 2083 and 2087 (cPanel/WHM ports) at the network level to protect customers until patches were available. cPanel/WHM is among the most widely deployed hosting control panels globally, putting shared hosting providers and their customers at immediate risk.

2. update from rapid7.com

   cPanel/WHM auth bypass (CVE-2026-41940) was exploited as a zero-day since at least February 23

   rapid7.com · 167d ago · April 30th, 2026

   Managed hosting provider KnownHost reports that CVE-2026-41940 was actively exploited in the wild prior to public disclosure, with targeted zero-day attacks potentially starting as early as February 23, 2026 — over two months before cPanel's April 28 emergency patch. Security firm watchTowr has published a technical analysis and proof-of-concept exploit demonstrating the CRLF injection technique that allows unauthenticated attackers to inject user=root into session files, bypassing encryption on the whostmgrsession cookie. Shodan enumerates approximately 1.5 million cPanel instances exposed to the internet.

3. update from bleepingcomputer.com

   cPanel CVE-2026-41940 escalates to mass ransomware deployment — "Sorry" encryptor breaches hundreds of websites

   bleepingcomputer.com · 164d ago · May 3rd, 2026

   The cPanel authentication bypass first disclosed on April 28 has crossed from reconnaissance and exploitation into active ransomware deployment. Attackers are now deploying a Go-based Linux encryptor called "Sorry" ransomware that appends the .sorry extension to encrypted files, using ChaCha20 for symmetric encryption with RSA-2048 key protection — making decryption impossible without the attacker's private key. Hundreds of compromised sites are already indexed in Google search results, with victims sharing samples on security forums. Shadowserver's count of 44,000+ compromised IPs (reported yesterday) underscores the massive attack surface being harvested. The ransomware leaves a standardized README.md note in each directory with a fixed Tox contact ID, indicating a single campaign operator rather than opportunistic exploitation by multiple groups. Organizations should also audit session directories for indicators of compromise, rotate all credentials, and verify that restored backups predate the February zero-day exploitation window.

4. update from securityweek.com

   cPanel CVE-2026-41940 — CISA adds to KEV with 4-day patch deadline as 40,000+ servers confirmed compromised in government and military targeting

   securityweek.com · 163d ago · May 4th, 2026

   CISA has added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within four days. The escalation comes as SecurityWeek reports over 40,000 servers likely compromised worldwide, with Shadowserver confirming 44,000 unique IPs scanning honeypots — numbers that spiked sharply after watchTowr Labs' public disclosure on April 28 but began dropping as of May 3 as organizations apply patches. New details from GBHackers reveal that threat actors weaponized the public PoC within days of disclosure to target government and military organizations across Southeast Asia, including the Philippine Coast Guard and the Lao Ministry of National Defense. The attackers combined cPanel exploitation with a separate custom exploit chain against an Indonesian defense-sector training portal, ultimately exfiltrating over 4 GB of documents including Chinese railway infrastructure data containing national identification numbers, bank account details, and phone numbers. After gaining access, the attackers deployed OpenVPN and Ligolo tunneling tools disguised as Linux services for persistent network pivoting.

5. update from gbhackers.com

   cPanel CVE-2026-41940 — Mr_Rot13 syndicate deploys Go-based infector with credential-harvesting JavaScript injection

   gbhackers.com · 155d ago · May 12th, 2026

   Detailed technical analysis of the ongoing cPanel/WHM exploitation campaign reveals a sophisticated operation by the Mr_Rot13 group, active for over six years with exceptionally low detection rates. Beyond the initial CVE-2026-41940 (CVSS 9.8) authentication bypass, the attackers deploy a custom Go-based payload infector that modifies root passwords, implants SSH public keys labeled cpanel-updater, drops a Python webshell, and injects malicious JavaScript into cPanel login interfaces to harvest admin credentials in real-time. Stolen data is exfiltrated via ROT13-obfuscated domains and Telegram channels. A cross-platform remote control Trojan (filemanager) provides persistent web-based GUI access with bcrypt authentication. The group's infrastructure links back to a 2022 PHP backdoor targeting WordPress that maintained zero detection for years. Ctrl-Alt-Intel reported that the campaign was used to infiltrate Southeast Asian government and military networks, exfiltrating 4 GB of sensitive data.

6. update from gbhackers.com

   Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers

   gbhackers.com · 23d ago · September 21st, 2026

   Threat actors rapidly exploited a critical authentication bypass in cPanel and WHM to compromise internet-facing hosting servers, with Japanese telemetry data linking the campaign to a sharp rise in Mirai-like scanning and attack traffic targeting Telnet services. The activity centers on CVE-2026-41940, a critical vulnerability in cPanel and WHM’s session-management layer that enables a remote, […] The post Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

7. update from cyberpress.org

   Mirai Botnet Activity Surges After Hackers Compromise cPanel Hosting Servers

   cyberpress.org · 22d ago · September 21st, 2026

   Japan’s JPCERT/CC reported that its TSUBAME Internet threat-monitoring sensors detected a major rise in malicious packets targeting Telnet services over TCP port 23. The surge began on April 30 and continued into early May before gradually declining. The traffic showed characteristics associated with Mirai and related variants. Mirai is widely known for infecting exposed Internet-connected devices and using them as bots for scanning, brute-force attacks, and distributed denial-of-service operations. However, the latest activity highlights that servers, not only consumer IoT devices , can also become part of botnet infrastructure. Investigators found that many source IP addresses involved in the scanning activity were assigned to hosting providers. When researchers accessed some of these addresses through a web browser, they found cPanel administration interfaces running on many of the systems. The observation data alone could not confirm the initial compromise method. Mirai Surges on cPanel The spike was not limited to one country or hosting provider. The United States ac

8. update from ift.tt

   Hackers Take Advantage of cPanel Vulnerability CVE-2026-41940 to Install Mirai Malware # internet # cybersecurity Hackers exploit cPanel CVE

   ift.tt · 22d ago · September 21st, 2026

   Hackers Take Advantage of cPanel Vulnerability CVE-2026-41940 to Install Mirai Malware # internet # cybersecurity Hackers exploit cPanel CVE

   via Mastodon https://ift.tt/U3wYSdn