whm

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. government agencies three days to secure their servers against an actively exploited vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin. Tracked as CVE-2026-48172, this high-severity vulnerability was reported by Namecheap and allows attackers with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux/CageFS. This vulnerability affects all user-end plugin versions before 2.4.8 and stems from a 'UNIX symlink following' weakness. LiteSpeed flagged it as actively exploited in early June and released urgent security updates, warning users to update the cPanel user-end plugin (bundled with the WHM plugin) to the latest version. Users are advised to use the following command to check if their server is vulnerable to attacks targeting the CVE-2026-48172 vulnerability: grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null "If this command results in any output, the vulnerability may have been exploited on your server. [..] To determine any damage done, examine the system logs for any actions taken by the detected IPs," LiteSpeed said. "This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions prior to 2.4.8." On Monday, CISA also added that the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV), ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems within three days, as required by Binding Operational Directive (BOD) 26-04. BOD 26-04 was issued last Wednesday (revoking the older BODs 19-02 and 22-01) and requires U.S. federal agencies to prioritize patching based on the risk of exploitation. Key factors to consider when assessing the risks include whether the security flaw is included in CISA's KEV catalog, whether the asset is publicly exposed online, whether exploitation can be automated for large-scale attacks, and whether successful exploitation grants attackers partial or total control of the targeted system. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency warned yesterday. "Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." Last month, CISA warned federal agencies to patch another LiteSpeed cPanel vulnerability (CVE-2026-48172), which unauthenticated attackers exploited to execute arbitrary scripts with root privileges. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

cPanel & WHM e WP Squared: PoC pubblico per lo sfruttamento della CVE-2026-29205 Alert AL04/260520/CSIRT-ITA Sintesi Aggiornamenti di sicurezza sanano cinque vulnerabilità di gravità “alta”, tra cui una con proof of concept (PoC) disponibile, presenti nei software cPanel & WHM e WP Squared, noti pannelli di controllo per l’hosting web. Tipologia Arbitrary File Read Privilege Escalation Information Disclosure Tampering Security Restrictions Bypass Descrizione e potenziali impatti È stato recentemente reso pubblico un Proof of Concept (PoC) per la CVE-2026-29205 – di tipo “Execution with Unnecessary Privileges” e con CVSS v3.1 pari a 8.6 – interessa il demone cpdavd, usato per servizi come calendario, contatti e WebDAV. Un utente malintenzionato remoto, tramite una richiesta HTTP opportunamente predisposta, potrebbe ottenere accesso in lettura a file arbitrari sui sistemi interessati. Prodotti e/o versioni affette cPanel & WHM 11.124.x, versioni precedenti alla 11.124.0.40 11.126.x, versioni precedenti alla 11.126.0.61 11.130.x, versioni precedenti alla 11.130.0.25 11.132.x, versioni precedenti alla 11.132.0.34 11.134.x, versioni precedenti alla 11.134.0.28 11.136.x, versioni precedenti alla 11.136.0.12 WP Squared 11.136.x, versioni precedenti alla 11.136.1.15 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti. https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026 https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026 https://support.cpanel.net/hc/en-us/articles/40437254183959-Security-CVE-2026-32991-cPanel-WHM-WP2-Security-Update-May-13-2026 https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026 https://support.cpanel.net/hc/en-us/articles/40437313190295-Security-CVE-2026-32993-cPanel-WHM-WP2-Security-Update-May-13-2026

Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE-2026-41940) Security researchers at XLab have outlined an active attack campaign targeting CVE-2026-41940, the recently disclosed vulnerability in cPanel & WHM, and have linked it to a stealthy hacking group that has been operating largely undetected for years. The vulnerability allows an attacker to log into a cPanel server without a username or password, effectively handing them administrator control over the cPanel host system, its configurations and databases, and the websites it manages. The attack campaign Once attackers gain access to a vulnerable server, they deploy an “infector” that first changes the server’s root password and plants a hidden login key so attackers can return via SSH, then drops a PHP web shell into the cPanel system, allowing remote file browsing and command execution. The attackers also tamper with the cPanel login page itself, injecting code that secretly harvests every username and password typed into it and sends them to an attacker-controlled server. A cross-platform remote-control trojan dubbed “Filemanager” is then installed, giving attackers an ongoing window into the compromised machine and the ability to manage it remotely. Database passwords, SSH keys, command history, and other data is exfiltrated both to the attackers’ own servers and to a private Telegram group. The attackers XLab’s attribution work points to a group they’ve dubbed “Mr_Rot13” based on the Telegram account handle used by the group’s apparent leader and the text-scrambling technique the group uses to hide the address of their command and control (C2) server. The group’s C2 domain (wrned.com) has been in active use since at least 2020, the researchers found. This, and the fact that a PHP backdoor associated with that domain has been uploaded to VirusTotal in 2022 and still has zero detections, led them to the conclusion that this is “a stable hacking group capable of operating covertly for years while remaining undiscovered.” XLab says the campaign is ongoing and shared indicators of compromise. CVE-2026-41940 exploitation Various threat actors have been exploiting CVE-2026-41940 to deploy ransomware, Mirai malware, and steal data. XLab says more than 2,000 attacker-controlled IP addresses worldwide are currently running automated attacks against exposed servers, with traffic originating primarily from Germany, the United States, Brazil, and the Netherlands. Yutaka Sejiyama, Deputy Director of Macnica’s Security Research Center, recently shared that 194 out of 1,692 publicly exposed cPanel/WHM servers in Japan have been hit with Sorry ransomware. CPanel has been updating their security advisory with links to patches for various cPanel and WHM (Web Host Manager) versions and new versions of a detection script. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager (WHM) that could result in an authentication bypass and allow remote attackers to gain elevated control of the control panel. According to a new report from QiAnXin XLab, the security defect has been exploited by a number of threat actors shortly after its public disclosure late last month, resulting in malicious behaviors like cryptocurrency mining, ransomware, botnet propagation, and backdoor implantation. "Monitoring data shows that more than 2,000 attacker source IPs worldwide are currently involved in automated attacks and cybercrime activities targeting this vulnerability," XLab researchers said. "These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions." Further analysis of the ongoing exploitation activity has uncovered a shell script that uses wget or curl to download a Go-based infector from a remote server ("cp.dene.[de[.]com") that first modifies the compromised cPanel system's root password to "123Qwe123C," plants an SSH public key for persistent access, and then drops a PHP web shell that facilitates file upload/download and remote command execution. The web shell is then used to inject JavaScript code to serve a customized login page to steal login credentials and siphon them to an attacker-controlled system that's encoded using the ROT13 cipher ("wrned[.]com"). Once the details are transmitted, the attack chain culminates with the deployment of a cross-platform backdoor that's capable of infecting Windows, macOS, and Linux systems. The infector is also equipped to collect sensitive information from the compromised host, including bash history, SSH data, device information, database passwords, and cPanel virtual aliases (aka valiases), to a 3-member Telegram group created by a user named "0xWR." In the infection sequence analyzed by XLab, Filemanager is delivered via a shell script downloaded from the "wpsock[.]com" domain. The backdoor supports file management, remote command execution, and shell functionality. There are signs that the threat actor behind the operation has been operating silently in the shadows for years. This assessment is based on the fact that the command-and-control (C2) domain embedded in the JavaScript code has been put to use in a PHP-based backdoor ("helper.php") that was uploaded to the VirusTotal platform in April 2022. The domain was first registered in October 2020. "Over the six years from 2020 to the present, the detection rate of Mr_Rot13's related samples and infrastructure across security products has remained extremely low," XLab said.

cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and denial-of-service. The list of vulnerabilities is as follows - CVE-2026-29201 (CVSS score: 4.3) - An insufficient input validation of the feature file name in the "feature::LOADFEATUREFILE" adminbin call that could result in an arbitrary file read. CVE-2026-29202 (CVSS score: 8.8) - An insufficient input validation of the "plugin" parameter in the "create_user API" call that could result in arbitrary Perl code execution on behalf of the already authenticated account's system user. CVE-2026-29203 (CVSS score: 8.8) - An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation. The shortcomings have been patched in the following versions - cPanel and WHM - - 11.136.0.9 and higher - 11.134.0.25 and higher - 11.132.0.31 and higher - 11.130.0.22 and higher - 11.126.0.58 and higher - 11.124.0.37 and higher - 11.118.0.66 and higher - 11.110.0.116 and higher - 11.110.0.117 and higher - 11.102.0.41 and higher - 11.94.0.30 and higher - 11.86.0.43 and higher WP Squared - - 11.136.1.10 and higher cPanel has released 110.0.114 as a direct update for customers who are still on CentOS 6 or CloudLinux 6. Users are advised to update to the latest versions for optimal protection. While there is no evidence that the vulnerabilities have been exploited in the wild, the disclosure comes days after another critical flaw in the product (CVE-2026-41940) has been weaponized by threat actors as a zero-day to deliver Mirai botnet variants and a ransomware strain called Sorry.

Security researchers are warning about a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM). This is a critical, actively exploited authentication-bypass bug in cPanel/WHM that lets attackers gain administrative access to the interface without credentials, potentially take over servers and all hosted sites. The vulnerability, tracked as CVE-2026-41940, has been added to the Known Exploited Vulnerabilities catalog by the Cybersecurity and Infrastructure Security Agency (CISA), meaning there is evidence it is being used in real-world attacks. Because cPanel/WHM is used by over a million sites worldwide, including banks and health organizations, the potential impact is huge. In simple terms, the bug can act like a front‑door key to a big chunk of the web’s hosting infrastructure. cPanel released patches on April 28, 2026, and urged all customers and hosts to update. It said all supported versions after 11.40 are affected, including DNSOnly and WP Squared. Hosting providers including Namecheap, HostGator, and KnownHost temporarily blocked access to cPanel interfaces while patching, treating this as a critical authentication bypass and reporting exploit attempts going back to late February 2026. How to stay safe While it’s up to the hosting companies and website owners to patch as quickly as possible, there are ways to reduce your risk if a site you use is compromised. As always, limit the data you share with websites to what’s absolutely necessary. Data they don’t have can’t be stolen. When ordering from an online retailer, don’t tick the box to save your card details for future purchases as they will be stored on the server. If there’s an option to check out as a guest, use it. It reduces the amount of personal data tied to an account. Don’t reuse passwords. When one site is compromised, having the same credentials in several places turns it into a multi‑account takeover problem. A password manager can help you create complex unique passphrases, and remember them for you. Where possible, pay by credit card. In many regions, this gives you stronger fraud protection. Are your details being used by cybercriminals? When a site you trust gets hacked If you think you’ve been affected by a data breach, take the following steps: Check the company’s advice. Every breach is different, so check with the company to find out what’s happened and follow any specific advice it offers. Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password, but 2FA that relies on a FIDO2 device can’t be phished. Watch out for impersonators. The thieves may contact you posing as the breached platform. Check the official website to see if it’s contacting victims and verify the identity of anyone who contacts you using a different communication channel. Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts. Consider not storing your card details. It’s definitely more convenient to let sites remember your card details, but it increases risk if a retailer suffers a breach. Set up identity monitoring, which alerts you if your personal information is found being traded illegally online and helps you recover after. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

cPanel & WHM e WP Squared: PoC pubblico per lo sfruttamento della CVE-2026-41940 Alert AL03/260430/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per la CVE-2026-41940 – già sanata dal vendor – presente nei software cPanel & WHM e WP Squared, noti pannelli di controllo per l’hosting web. Tale vulnerabilità, qualora sfruttata, potrebbe permettere a un utente malintenzionato remoto non autenticato di ottenere accesso amministrativo e di prendere il controllo totale dei servizi di hosting gestiti. Tipologia Authentication Bypass Descrizione e potenziali impatti La vulnerabilità, tracciata tramite la CVE-2026-41940 – di tipo “Missing Authentication for Critical Function” e con CVSS v3.1 pari a 9.8 – interessa il demone cpsrvd, in particolare il flusso di autenticazione HTTP Basic, e deriva da una gestione non sicura delle sessioni pre‑autenticazione in quanto specifici valori di input controllati dall’utente, in particolare il campo relativo alla password, non vengono sanificati in modo adeguato nel contesto del salvataggio della sessione, consentendo la manipolazione dello stato di autenticazione. La vulnerabilità sfrutta quindi la caratteristica di cPanel & WHM di creare, anche per i tentativi di accesso non riusciti, una sessione pre‑autenticata e persistente su disco, che viene utilizzata dal demone cpsrvd come meccanismo di mantenimento dello stato tra richieste successive e rappresenta la base su cui viene successivamente effettuata la promozione a sessione autenticata. La combinazione di questi fattori fa sì che gli input controllati dall’attaccante vengano inseriti nella struttura di sessione e, attraverso i normali meccanismi di persistenza, salvati nel file di sessione. A causa della struttura e del formato delle sessioni utilizzate da cPanel, tali dati possono poi essere interpretati, durante il ricaricamento della sessione, come campi di sessione legittimi, permettendo la manipolazione dello stato di autenticazione e l’elusione dei controlli di accesso previsti. Il risultato di questo processo è un bypass completo dell’autenticazione, che può portare all’accesso non autorizzato al pannello di controllo. Nei casi più gravi, l’attaccante può ottenere privilegi amministrativi, inclusi quelli a livello WHM/root, con conseguente compromissione dell’intero server. Prodotti e/o versioni affette cPanel & WHM 11.86.x versioni precedenti alla 11.86.0.41 11.110.x versioni precedenti alla 11.110.0.97 11.118.x versioni precedenti alla 11.118.0.63 11.126.x versioni precedenti alla 11.126.0.54 11.130.x versioni precedenti alla 11.130.0.19 11.132.x versioni precedenti alla 11.132.0.29 11.134.x versioni precedenti alla 11.134.0.20 11.136.x versioni precedenti alla 11.136.0.5 WP Squared versioni precedenti alla 136.1.7 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since late February. It is unclear when exploitation started, but KnownHost, a hosting provider that uses cPanel, said the day the vulnerability was disclosed that "successful exploits have been seen in the wild" before a fix became available. However, KnownHost CEO Daniel Pearson stated that the company has "seen execution attempts as early as 2/23/2026." Newly published technical details, which can be used to develop an exploit, reveal that the issue is a "Carriage Return Line Feed (CRLF) injection in the login and session loading processes of cPanel & WHM." cPanel released a fix on April 28, following pressure from hosting providers. To protect customers, Namecheap temporarily blocked connections to cPanel and WHM ports 2083 and 2087 until patches became available. A report from offensive security company watchTowr explains that the flaw is caused by improper session handling in cPanel & WHM, where user-controlled input from the Authorization header is written into server-side session files before authentication and without proper sanitization. watchTowr researchers also published a detailed analysis on how the bug can be triggered to log into the system without validating the provided password, which can be used to develop a working exploit. According to Rapid7, Shodan internet scans show that there are approximately 1.5 million cPanel instances exposed online. However, there is no data on how many are vulnerable to CVE-2026-41940. “Successful exploitation of CVE-2026-41940 grants an attacker control over the cPanel host system, its configurations and databases, and websites it manages,” Rapid7 warns. cPanel has updated its security advisory, noting that the vulnerability also impacts WP Squared, a comprehensive management panel for WordPress hosting built on cPanel. Furthermore, unlike initially stated, only cPanel versions after 11.40 are affected by the security issue. The vendor strongly recommends that all customers restart the ‘cpsrvd’ service after installing the latest releases of the software: Affected releases and fixed versions are: cPanel/WHM 11.110.0 → fixed in 11.110.0.97 cPanel/WHM 11.118.0 → fixed in 11.118.0.63 cPanel/WHM 11.126.0 → fixed in 11.126.0.54 cPanel/WHM 11.132.0 → fixed in 11.132.0.29 cPanel/WHM 11.134.0 → fixed in 11.134.0.20 cPanel/WHM 11.136.0 → fixed in 11.136.0.5 WP Squared 11.136.1 → fixed in 11.136.1.7 If patching isn’t immediately possible, customers should at least block external access to ports 2083, 2087, 2095, and 2096, or stop the cpsrvd and cpdavd cPanel internal core services. The vendor also provided a detection script to check for compromise. If indicators are found, it’s recommended to purge sessions, reset all credentials, audit logs, and investigate persistence mechanisms. watchTowr has also published a Detection Artifact Generator script that can be used to verify if cPanel and WHM instances are vulnerable to CVE-2026-41940. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Hackers have been exploiting a critical-severity authentication bypass vulnerability in the cPanel & WHM (WebHost Manager) server and site management platform for months. Tracked as CVE-2026-41940 (CVSS score of 9.8), the flaw was disclosed on April 28, when cPanel urged immediate patching, warning that all software versions after 11.40 are affected, but refraining from sharing technical information. Affecting the login flow, the security defect could allow remote, unauthenticated attackers to gain administrative access to the control panel, essentially leading to system takeover. As the Canadian Centre for Cyber Security points out, successful exploitation of the issue could allow an attacker to modify server configurations and potentially compromise all websites on shared hosting servers. “Successful exploitation of CVE-2026-41940 grants an attacker control over the cPanel host system, its configurations and databases, and websites it manages,” cybersecurity firm Rapid7 notes. A Shodan search, the company warns, shows around 1.5 million internet-accessible cPanel instances that may be exposed to attacks. Analyzing CVE-2026-41940, attack surface management firm WatchTowr discovered that upon a failed login attempt, the cPanel service daemon would write a pre-authentication session file to the disk, and that an attacker could manipulate a cookie so that attacker-controlled credentials are written to it in plaintext. Essentially, the bug allows an attacker to inject specific characters via an authorization header to write specific parameters to the session file, and then trigger a reload of the file to authenticate using the injected credentials. According to a Reddit post by hosting provider KnownHost, the vulnerability has been exploited in the wild since February 23, 2026. Immediately after being notified of the issue, KnownHost, HostPapa, InMotion, Namecheap, and other hosting providers blocked access to cPanel & WHM ports to securely deploy patches. The fixes were included in cPanel & WHM versions 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.136.0.5, and 11.134.0.20, and in WP Squared version 136.1.7. “If your server is not running a supported version of cPanel that is eligible for this update, it is highly recommended that you work toward updating your server as soon as possible, as it may also be affected,” cPanel notes in its advisory. cPanel has published a detection script, and WatchTowr released a Detection Artifact Generator to help administrators identify signs of compromise. Related: ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover Related: Fresh LiteLLM Vulnerability Exploited Shortly After Disclosure Related: Chrome 147, Firefox 150 Security Updates Rolling Out Related: Apple Patches iOS Flaw Allowing Recovery of Deleted Chats

SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Version 1.0: cPanel und WHM - Aktiv ausgenutzte Schwachstelle ermöglicht Umgehen der Authentifizierung Kritikalität 3 Beschreibung Am 28. April 2026 veröffentlichte der Hersteller cPanel ein Advisory zu einer kritischen Schwachstelle in der gleichnamigen Hosting-Verwaltungssoftware, welche das Umgehen der Authentifizierung ermöglicht. Kurz darauf wurden technische Details zu der Schwachstelle von dem IT-Sicherheitsunternehmen watchTowr Labs veröffentlicht und das Advisory des Herstellers mit Detektionsmöglichkeiten zur Erkennung von Kompromittierungen ergänzt. Die Schwachstelle mit der Kennung CVE-2026-41940 erlaubt einem entfernten, nicht authentifizierten Angreifer sich unberechtigten Zugriff auf das Control Panel zu verschaffen und wurde demnach mit einem CVSS-Score von 9.8 "kritisch" bewertet. Aktuellen Berichten im Internet zufolge könnte die Schwachstelle bereits seit einigen Wochen als Zero-Day ausgenutzt worden sein, um Zugriff auf Server zu erlangen. Eine Prüfung auf eine vorangegangene Kompromittierung und unberechtigten Zugriff ist daher zwingend notwendig.

cPanel heeft een kwetsbaarheid verholpen in cPanel en WHM producten, inclusief versies na 11.40 en vóór de specifieke gepatchte releases. De kwetsbaarheid betreft een authenticatieomzeiling die ontstaat door CRLF-injectie in sessiebestanden, waardoor aanvallers sessies kunnen vervalsen. Daarnaast is de loginflow zelf kwetsbaar, waardoor niet-geauthenticeerde externe aanvallers de authenticatiemechanismen kunnen omzeilen. Hierdoor kan ongeautoriseerde toegang tot het WHM control panel met rootrechten worden verkregen.

A critical vulnerability affecting all but the latest versions of cPanel and the WebHost Manager (WHM) dashboard could be exploited to obtain access to the control panel without authentication. The security issue, currently identified as CVE-2026-41940 and with a severity score of 9.8, has been addressed in an emergency update that requires running a command manually to retrieve a patched version of the software. Owned by WebPros International, WHM and cPanel are Linux-based web hosting control panels for server and website management. While WHM provides server-level control, cPanel provides administrator access to the website backend, webmail, and databases. Both products are among the most widely deployed hosting control panels, popular with many hosting providers for their standardized interfaces, ease of use for non-technical users, and deep integration with common hosting stacks. No technical details have been publicly disclosed, but the severity of the issue appears significant, as Namecheap temporarily blocked access to ports 2083 and 2087 used for WHM and cPanel to protect customers until patches were available. "We regret to inform you that a critical security vulnerability has been identified in cPanel software affecting all currently supported versions," Namecheap said. The hosting provider stated that the vulnerability "relates to an authentication login exploit that could allow unauthorized access to the control panel.” A few hours after Namecheap's notification, cPanel published a security bulletin informing that the security issue had been addressed in the following product versions: 11.110.0.97 11.118.0.63 11.126.0.54 11.132.0.29 11.136.0.5 11.134.0.20 To install a safe version, the vendor recommends that administrators execute the command /scripts/upcp –force, which runs the cPanel update process and forces it to execute even if the system thinks it already runs on the latest version. Servers running an unsupported version of cPanel are ineligible for security updates. In this case, administrators are recommended to upgrade to a supported version as soon as possible. An attacker gaining access to cPanel can control everything present in the hosting account, from websites and data to email. They can use the access to plant backdoors or web shells, redirect users to malicious locations, steal sensitive files, send spam or phishing emails, or collect passwords from configuration files. WHM provides access to the entire server and all the websites it hosts. This means that a threat actor could create and delete cPanel accounts, establish persistent access on the machine, and use it for various malicious activities (e.g., proxy traffic, spam, malware delivery, botnet). Website owners using the affected management interfaces should ensure that they have updated to a patched version. Update [April 29, 16:51 EST]: Added the tracking number assigned by VulnCheck. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The ImunifyAV malware scanner for Linux servers, used by tens of millions of websites, is vulnerable to a remote code execution vulnerability that could be exploited to compromise the hosting environment. The issue affects versions of the AI-bolit malware scanning component prior to 32.7.4.0. The component is present in the Imunify360 suite, the paid ImunifyAV+, and in ImunifyAV, the free version of the malware scanner. According to security firm Patchstack, the vulnerability has been known since late October, when ImunifyAV's vendor, CloudLinux, released fixes. Currently, the flaw has not been assigned an identifier. On November 10, the vendor backported the fix to older Imunify360 AV versions. In an advisory yesterday, CloudLinux warned customers about "a critical security vulnerability" and recommended to "update the software as soon as possible" to version 32.7.4.0 ImunifyAV is part of the Imunify360 security suite, mostly used by web-hosting providers or generic Linux shared hosting environments. The product is typically installed at the hosting platform level, not by end-users directly. It is extremely common on shared hosting plans, managed WordPress hosting, cPanel/WHM servers, and Plesk servers. Website owners rarely interact with it directly, but it is still a ubiquitous tool running silently behind 56 million websites, according to Imunify data from October 2024, which also claims more than 645,000 Imunify360 installations. The root cause of the flaw is AI-bolit's deobfuscation logic, which executes attacker-controlled function names and data extracted from obfuscated PHP files when trying to unpack malware for scanning it. This occurs because the tool uses 'call_user_func_array' without validating the function names, allowing execution of dangerous PHP functions such as system, exec, shell_exec, passthru, eval, and more. Patchstack notes that exploiting the vulnerability requires Imunify360 AV to perform active deobfuscation during the analysis step, which is disabled in the default configuration of the standalone AI-Bolit CLI. However, the Imunify360 integration of the scanner component is forcing an 'always on' state for background scans, on-demand scans, user-initiated scans, and rapid scans, which meets the exploitation requirement. The researchers shared a proof of concept (PoC) exploit that creates a PHP file in the tmp directory, which will trigger remote code execution when scanned by the antivirus. This could enable full website compromise, and if the scanner runs with elevated privileges in shared hosting setups, the implications could extend to full server takeover. CloudLinux's fix adds a whitelisting mechanism that only allows safe, deterministic functions to execute during deobfuscation, which blocks arbitrary function execution. Despite the lack of clear warnings from the vendor or a CVE-ID that would help raise the alarm and track the issue, system administrators should upgrade to version v32.7.4.0 or newer. Currently, there are no official instructions on how to check for compromise, no detection guidance, and no confirmation of active exploitation in the wild. BleepingComputer has contacted CloudLinux with a request for comment, but we have not received a response by publishing time. Update 11/16 - Further examination by Patchstach researchers uncovered that the issue is more severe than initially anticipated due to the existence of an easier exploitation vector that does not require uploading malware. More details available on this update. Update 11/17 - Immunify360 published a security advisory with recommended actions and temporary workaround. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report