A critical vulnerability in cPanel and WHM, tracked as CVE-2026-41940, allows attackers to bypass authentication and gain full server access. It may have been actively exploited since late February, potentially affecting millions of domains, but emergency patches are now available.
-
Critical flaw lets hackers bypass login and seize server.
-
Attacks may have been happening weeks before discovery.
-
Patch released, but outdated systems remain exposed.
-
Tens of millions of websites could be impacted.
The vulnerability affects all supported versions of the software released prior to the patch.
Although the exact date of the first exploitation is not known, KnownHost CEO Daniel Pearson said that there were recorded "execution attempts as early as [February 23rd, 2026]."
cPanel released a fix on April 28th, just a few hours after the public advisory was published. Hosting providers, including Namecheap and KnownHost, quickly moved to block cPanel-related ports pending the patch.
cPanel warns that servers running unsupported or end-of-life versions should update as soon as possible via a full platform upgrade, although they will not receive an emergency patch.
The affected cPanel and WebHost Manager (WHM) are used across 70 million domains, according to The Register.
Check if your data has been leaked
These are popular Linux-based tools used to run web servers and hosting accounts. cPanel allows to manage files, domain, and databases, while WHM is used by server administrators.
They are among the most widely used hosting control panels in the industry, with over a million server installations as of 2026, which makes them an attractive target for cybercriminals.
The vulnerability also affects WP Squared, a hosting platform for WordPress owned by cPanel.
A successful exploit could have a critical impact on websites and hosting environments, allowing attackers to compromise cPanel accounts, install backdoors, deploy malware or ransomware, extract customer data, or abuse servers for malicious operations.
The exploit hasn’t yet been attributed to a specific attacker.
Website owners are encouraged to review their logs for unusual login attempts, newly created users, or unusual cron jobs prior to the patch. On top of that, it’s recommended to use 2FA for access to all WHM and cPanel accounts and restrict WHM port access to trusted IP addresses via firewall rules.
Your email address will not be published. Required fields are markedmarked