🔴 cPanel CVE-2026-41940: 44,000 Servers Hacked - Immediate...

⚠️ CRITICAL SECURITY ALERT - Last Updated: May 5, 2026, 06:00 UTC

A critical authentication bypass vulnerability in cPanel/WHM is being actively exploited. Over 44,000 servers have been compromised worldwide. If you run cPanel/WHM, you need to act NOW.

What Is CVE-2026-41940?

CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM versions prior to 126.0.15, 124.0.12, and 122.0.18. The vulnerability allows unauthenticated remote attackers to bypass authentication and gain administrative access to cPanel/WHM interfaces.

Key Details:

How the Exploit Works

The vulnerability exists in cPanel's session handling mechanism. Attackers can craft malicious requests that trick the authentication system into granting administrative privileges without valid credentials. Once inside, attackers can:

• QR Code Generator Create new administrative accounts
• Access all hosted websites and databases
• Install backdoors and web shells
• Exfiltrate sensitive customer data
• Use compromised servers for further attacks (botnet expansion)

Who Is Affected?

Directly Affected:

✅ cPanel/WHM server administrators running unpatched versions
✅ Web hosting providers using cPanel for customer management
✅ Reseller hosting accounts with WHM access
✅ Dedicated server owners with cPanel installations
✅ VPS users with cPanel/WHM control panels

Indirectly Affected:

⚠️ Website owners hosted on compromised cPanel servers
⚠️ E-commerce sites processing payments on affected servers
⚠️ Businesses storing customer data on compromised hosting
⚠️ Email users whose accounts are hosted on affected servers

If you're unsure whether your hosting uses cPanel: Contact your hosting provider immediately and ask specifically about CVE-2026-41940 patching status.

How to Check If Your Server Is Compromised

Step 1: Check Your cPanel Version

Log into WHM and check the version displayed in the top-right corner. If you're running any of these versions, you're VULNERABLE:

• 126.0.14 and below
• 124.0.11 and below
• 122.0.17 and below

Command line check:

/usr/local/cpanel/cpanel -V

Step 2: Look for Indicators of Compromise (IOCs)

Check your server for these common signs of compromise:

Suspicious Administrative Accounts:

cat /etc/passwd | grep -E "cpanel|admin|support"

Unauthorized API Tokens:

whmapi1 api_token_list

Recent File Modifications in cPanel Directories:

find /usr/local/cpanel -type f -mtime -3 -ls

Suspicious Processes:

ps aux | grep -E "perl|python|curl|wget"

Web Shell Indicators:

find /home -name "*.php" -type f | xargs grep -l "eval(base64_decode"

Step 3: Check Access Logs

Look for unusual login patterns:

grep "login" /usr/local/cpanel/logs/access_log | tail -100

Watch for: - Logins from unusual IP addresses - Multiple failed logins followed by success - Access at unusual hours - Requests to /login without prior authentication steps

Immediate Steps to Take (Priority Order)

🔴 PRIORITY 1: Patch NOW (Within 1 Hour)

Update cPanel/WHM immediately:

# Force cPanel update to latest version
/scripts/upcp --force

# Or use WHM interface:
# WHM → Home → cPanel → Upgrade to Latest Version

Verify the update:

/usr/local/cpanel/cpanel -V

Expected output should show: - 126.0.15 or higher - 124.0.12 or higher
- 122.0.18 or higher

🟠 PRIORITY 2: Rotate All Credentials (Within 2 Hours)

1. Change WHM root password
2. Reset all cPanel account passwords
3. Revoke and regenerate all API tokens
4. Update SSH keys - Remove all authorized_keys and regenerate
5. Change MySQL root password
6. Reset email account passwords

# Reset all cPanel passwords
for user in $(cat /etc/domainusers | cut -d: -f1); do
    passwd $user
    # Generate strong password and document securely
done

🟡 PRIORITY 3: Audit and Clean (Within 4 Hours)

1. Review all administrative accounts - Remove any unauthorized accounts
2. Check for backdoors - Scan for web shells and malicious files
3. Review cron jobs - Check for unauthorized scheduled tasks
4. Audit installed plugins/modules - Remove anything suspicious
5. Check DNS records - Ensure no unauthorized changes

🟢 PRIORITY 4: Harden Your Server (Within 24 Hours)

1. Enable two-factor authentication on WHM and all cPanel accounts
2. Restrict WHM access by IP address
3. Implement fail2ban or similar brute-force protection
4. Enable cPHulk brute force protection
5. Review and tighten firewall rules
6. Set up monitoring for suspicious activity

How to Patch & Update cPanel/WHM

Automatic Update (Recommended)

# Run cPanel update
/scripts/upcp

# Monitor update progress
tail -f /var/log/cpanel-update.log

Manual Update Steps

If automatic update fails:

1. Download latest installer:

cd /home
curl -o latest -L https://securedownloads.cpanel.net/latest

2. Run installer:

sh latest

3. Verify installation:

/usr/local/cpanel/cpanel -V

Post-Update Verification

# Check cPanel services status
/scripts/restartsrv_cpsrvd

# Verify Apache is running
/scripts/restartsrv_httpd

# Check MySQL/MariaDB
/scripts/restartsrv_mysql

# Test website functionality

Indicators of Compromise (IOC) List

Known Malicious IPs:

• 185.220.101.x range
• 194.32.107.x range
• 103.75.201.x range
• Various Tor exit nodes

Known Malicious Files:

/usr/local/cpanel/whostmgr/docroot/cgi/.hidden/
/tmp/.cpanel/
/home/*/public_html/.well-known/.hidden/
/usr/local/cpanel/base/frontend/.cache/

Known Backdoor Signatures:

• Files containing eval(base64_decode(
• Files with random alphanumeric names (e.g., a7x9k2m4.php)
• Modified cPanel core files with additional functions
• Unauthorized cron jobs downloading external scripts

Threat Actor Analysis

Attribution:

Current intelligence suggests multiple threat actor groups are exploiting this vulnerability:

1. Initial Access Brokers - Compromising servers to sell access
2. Cryptojacking Groups - Installing mining malware
3. Ransomware Affiliates - Preparing for encryption attacks
4. Data Theft Operations - Exfiltrating customer databases

Exploitation Timeline:

Long-Term Protection Measures

1. Implement Defense in Depth

• Web Application Firewall (WAF) - Filter malicious requests before they reach cPanel
• Intrusion Detection System (IDS) - Monitor for suspicious activity
• File Integrity Monitoring - Alert on unauthorized file changes
• Log Aggregation - Centralize logs for analysis

2. Regular Security Practices

• Weekly automated updates - Keep cPanel and all software current
• Monthly security audits - Review accounts, permissions, and access logs
• Quarterly penetration testing - Identify vulnerabilities before attackers do
• Annual security assessments - Comprehensive review of security posture

3. Backup Strategy

• 3-2-1 backup rule - 3 copies, 2 different media, 1 offsite
• Immutable backups - Protect backups from ransomware
• Regular restore testing - Verify backups work when needed
• Encrypted backups - Protect data in transit and at rest

Should You Switch Hosting Providers?

If your current hosting provider has not patched CVE-2026-41940 by May 5, 2026, 12:00 UTC, consider this a serious red flag.

Questions to Ask Your Provider:

1. ✅ Have you patched CVE-2026-41940?
2. ✅ When did you apply the patch?
3. ✅ Have you checked for compromise indicators?
4. ✅ What additional security measures have you implemented?
5. ✅ Will you provide a security incident report?

Secure Hosting Alternatives

If you're managing your own server and finding it overwhelming, consider managed hosting with stronger security:

• [AFFILIATE_LINK:Liquid Web / Nexcess] - Premium managed hosting with proactive security monitoring and 24/7 support. Starting from $19/month with enterprise-grade protection.

• [AFFILIATE_LINK:Hostinger] - Budget-friendly secure hosting with automatic patching, DDoS protection, and free SSL. Plans from $2.99/month.

For additional server security, consider:

• Bitdefender - Server security software with advanced threat detection and automated response. Protects against malware, ransomware, and zero-day exploits.

FTC Disclosure: Some links in this article are affiliate links. We may earn a commission if you purchase through these links, at no extra cost to you. This helps support our independent security research.

FAQ

Q: How do I know if my website is on a cPanel server?

A: Check with your hosting provider, or look for cPanel login URLs like yourdomain.com:2083 or yourdomain.com/cpanel. You can also check your hosting control panel - if it says "cPanel" anywhere, you're affected.

Q: I've updated cPanel. Am I safe now?

A: Updating closes the vulnerability, but if your server was already compromised, the attacker may have left backdoors. You MUST also rotate all passwords, check for unauthorized accounts, and scan for malware.

Q: What if I can't update cPanel immediately?

A: As an emergency measure, restrict WHM/cPanel access to specific IP addresses only:

# Block all access except your IP
iptables -A INPUT -p tcp --dport 2087 -s YOUR_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 2087 -j DROP

Q: Will my website visitors be affected?

A: If your server is compromised, visitors could be redirected to malicious sites, have malware downloaded, or have their data stolen. Check your website for unauthorized changes immediately.

Q: How long do I have to patch?

A: You should patch immediately. Every minute your server is unpatched increases the risk of compromise. Mass exploitation is ongoing and automated.

Q: Can shared hosting users do anything?

A: Shared hosting users cannot patch cPanel themselves - this is your hosting provider's responsibility. Contact them immediately and ask about CVE-2026-41940. If they haven't patched, demand action or switch providers.

Q: What data could be stolen?

A: If compromised, attackers can access: website files, databases, email accounts, customer data, payment information, and any other data stored on the server.

Q: Should I pay for a security audit?

A: If you handle sensitive customer data or process payments, yes. Professional security audits ($500-$5,000) can identify backdoors and ensure complete remediation. For small personal sites, follow the IOC checks above carefully.

Timeline of Events

Internal Resources

• [INTERNAL_LINK:complete small business cybersecurity guide] - Comprehensive security framework for ongoing protection
• [INTERNAL_LINK:secure your remote access] - VPN and remote access security recommendations
• [INTERNAL_LINK:compare the best security tools] - Tool comparison for long-term security planning

Emergency Contacts

• cPanel Security Team: [email protected]
• CISA: [email protected]
• FBI IC3: ic3.gov (for significant data breaches)
• Your Hosting Provider: [Contact immediately]

This guide is updated in real-time as new information becomes available. Last updated: May 5, 2026, 06:00 UTC.

© 2026 HERMES Security. This content is for educational purposes. Always consult with security professionals for critical infrastructure.