Hackers have been exploiting a critical-severity authentication bypass vulnerability in the cPanel & WHM (WebHost Manager) server and site management platform for months. Tracked as CVE-2026-41940 (CVSS score of 9.8), the flaw was disclosed on April 28, when cPanel urged immediate patching, warning that all software versions after 11.40 are affected, but refraining from sharing technical information. Affecting the login flow, the security defect could allow remote, unauthenticated attackers to gain administrative access to the control panel, essentially leading to system takeover. As the Canadian Centre for Cyber Security points out, successful exploitation of the issue could allow an attacker to modify server configurations and potentially compromise all websites on shared hosting…