CVE-2026-41940

A threat actor named Mr_Rot13 is exploiting a cPanel vulnerability to deploy a backdoor called Filemanager, leveraging CVE-2026-41940 to bypass authentication and gain elevated control. The vulnerability affects cPanel and WebHost Manager, allowing remote attackers to compromise environments. This active exploitation poses a significant security risk.

A critical cPanel vulnerability (CVE-2026-41940) is being widely exploited for 'Sorry' ransomware attacks, leading to website breaches and data encryption. The flaw allows attackers to breach systems and encrypt data, resulting in ransomware incidents.

CISA has mandated federal agencies to patch the cPanel vulnerability CVE-2026-41940 by Sunday. Rapid7's incident responders warned that successful exploitation allows attackers full control over cPanel systems, configurations, databases, and managed websites.

A critical authentication bypass vulnerability, CVE-2026-41940, has been discovered in CPanel/WHM, allowing attackers to bypass login screens and gain unauthorized access. The flaw, reported by Watchtowr Labs, has sparked widespread concern about server security.

cPanel's authentication bypass vulnerability (CVE-2026-41940) is being actively exploited, affecting all supported versions since 11.40 and WP Squared. CISA added it to its KEV list, while cPanel released a patch addressing the flaw, which allows attackers to inject malicious data during login to bypass authentication.

A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, WHM, and WP Squared is being actively exploited in the wild as a zero-day attack, with proof-of-concept (PoC) code now available. The flaw has been leveraged since late February, highlighting urgent security risks for users of these platforms.