Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.
Threat actors exploited CVE-2026-41940, a CVSS 9.8 authentication bypass in cPanel and WHM session handling, to access internet-facing hosting servers. cPanel patched the issue on April 28, 2026, but activity surged from April 30, and JPCERT/CC linked a sharp rise in Mirai-like Telnet traffic in Japan to the flaw using Censys and NICTER intelligence. Censys found roughly 80 percent of hosts newly classified as malicious on May 1 were running cPanel or WHM. Researchers observed Mirai-family malware and separate ransomware that encrypts files with a ".sorry" extension.
- CVE-2026-41940 is a CVSS 9.8 unauthenticated cPanel and WHM session bypass.
- Fixes shipped April 28, 2026; exploitation surged from April 30.
- About 80% of hosts newly marked malicious on May 1 ran cPanel or WHM.
- Post-exploitation included Mirai-family malware and ransomware appending ".sorry".
- Patched builds include 11.110.0.97, 11.132.0.29, and 11.136.0.5.
- CVEs
- CVE-2026-41940
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1046 Network Service Discovery
- Vendors
- cPanel
- Products
- cPanelWHMWP Squared
- Malware
- Mirai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 11.136.0.5 | 63, 11.126.0.54, 11.130.0.18, 11.132.0.29, 11.134.0.20, and 11.136.0.5. Until systems are patched, organizations should restrict a |
From the original article
3 min read at gbhackers.com
Threat actors rapidly exploited a critical authentication bypass in cPanel and WHM to compromise internet-facing hosting servers, with Japanese telemetry data linking the campaign to a sharp rise in Mirai-like scanning and attack traffic targeting Telnet services. The activity centers on CVE-2026-41940, a critical vulnerability in cPanel and WHM’s session-management layer that enables a remote, […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.