Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks

A previously unknown threat actor is targeting government and military entities in Southeast Asia by exploiting a cPanel vulnerability, alongside managed service providers and hosting providers in several countries. The activity was detected on May 2, 2026, and involves exploiting a recently disclosed vulnerability. This affects networks in the Philippines, Laos, Canada, South Africa, and the U.S.