Reported by 1 outlet

Timeline

1. original reporting

   cPanelSniper PoC released as Shadowserver confirms 44,000 compromised IPs actively scanning

   cyberpress.org · 165d ago · May 2nd, 2026

   Mass exploitation of CVE-2026-41940 has escalated dramatically since yesterday's report of zero-day exploitation dating back to February. Security researcher Yunus Emre Öztaş has published "cPanelSniper," a weaponized proof-of-concept framework that requires no external dependencies and runs entirely with standard Python libraries, automating a four-stage attack that grants immediate interactive root shell access to affected servers. The Shadowserver Foundation has confirmed at least 44,000 unique IP addresses are already compromised and actively scanning honeypots as of April 30. The exploit works by injecting CRLF characters into the HTTP Authorization header, writing malicious session data declaring user=root directly into disk-based session files before sanitization occurs. Passwords and MFA offer zero protection against this authentication bypass. cPanel/WHM powers tens of millions of domains globally, and the emergency patch must be manually installed via /usr/local/cpanel/scripts/upcp — automatic update channels do not deliver it. Organizations must immediately verify patching, audit session directories for indicators of compromise, rotate all administrative credentials, and monitor for unauthorized accounts.