CVE-2026-41940

A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager (WHM) that could result in an authentication bypass and allow remote attackers to gain elevated control of the control [xlite_meta score:59 src:The Hacker News xlite_fp:44fb5f3b3406672aafeb2878ce6164fa233564e678a836b590257c48d8ab0832]

The attacks likely target CVE-2026-41940, a recently patched zero-day leading to administrative access. The post Over 40,000 Servers Compromised in Ongoing cPanel Exploitation appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:07a3f173ad0e8908536ee6561caa5ac8c2371d7c966d6ea9ef02692b6c9527fc]

A new disclosed cPanel flaw tracked as CVE-2026-41940 is being mass-exploited to breach websites and encrypt data in "Sorry" ransomware attacks. [...] [xlite_meta score:64 src:BleepingComputer xlite_fp:a8e4723c32f33c94079c9c1f69c78b2e336f511e6fd3a33c6af864fb847fdf6f]

Incident responders at Rapid7 said successful exploitation of CVE-2026-41940 “grants an attacker control over the cPanel host system, its configurations and databases, and websites it manages.” [xlite_meta score:56 src:The Record xlite_fp:568936c4cb24644c2a07fe71e7c56bb807fe51fd299bdfb19a0b0936d81e13d7]

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabiliti [xlite_meta score:58 src:CISA Alerts xlite_fp:4092e05bde124d85245bc4b4de328f91eed31134c125a30125e4356bebf4cf8c]

The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since late February. [...] [xlite_meta score:70 src:BleepingComputer xlite_fp:67d50bd8437bd65b5f553e0d208256f0c7645aa27505cf9822304aa8a2f623b4]