cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | de.com | ownload a Go-based infector from a remote server ("cp.dene.[de[.]com") that first modifies the compromised cPanel system's roo |
| domain | wpsock.com | anager is delivered via a shell script downloaded from the "wpsock[.]com" domain. The backdoor supports file management, remote co |
| domain | wrned.com | -controlled system that's encoded using the ROT13 cipher (" wrned[.]com "). Once the details are transmitted, the attack chain cu |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan May 11, 2026 Vulnerability / Ransomware A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.