cPanel/WHM auth bypass flaw mass exploited
Unauthenticated attackers are exploiting a cPanel/WHM/WP Squared auth bypass (CVE-2026-41940) for root RCE, deploying ransomware, Mirai, and espionage tools.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-41940 as exploited in the wild.
CVE-2026-41940 is an authentication bypass in the WHM/cPanel login flow affecting versions after 11.40, allowing unauthenticated remote attackers to gain administrative access and achieve root-level remote code execution via legitimate WHM API functionality. The flaw requires only a handful of HTTP requests and no credentials, making it trivial to weaponize. watchTowr Labs published technical analysis and PoC code, and the vulnerability has been added to CISA's KEV catalog following confirmed in-the-wild exploitation.
According to KnownHost's CEO, exploitation began as early as February 23, 2026 — roughly two months before cPanel's emergency patch on April 28, 2026 — indicating attackers had a significant head start before public disclosure. Since disclosure, exploitation has accelerated sharply, with Shadowserver tracking 44,000 IP addresses associated with active scanning and exploit attempts against internet-exposed cPanel/WHM instances.
Post-compromise activity is varied and includes deployment of a Go-based Linux encryptor tied to the "Sorry" ransomware operation, Mirai botnet installation, credential harvesting, and espionage operations targeting government and military entities in Southeast Asia. Given the scale of internet-exposed cPanel/WHM installations, the ease of exploitation, and the diversity of malicious follow-on activity, organizations running affected versions should patch immediately.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-whm-cpanel-and-wp-squared-could-allow-for-remote-code-execution_2026-042
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs