Ongoing Cyberattacks Target cPanel Servers Exploiting Critical Vulnerability

Tue, 05 May 2026 00:10:00 +0200

Nearly a week after cPanel and WebHost Manager (WHM) disclosed a critical vulnerability in their web server management software, cybercriminals continue to exploit the flaw, putting thousands of websites at risk. Shadowserver reports over 550,000 servers are potentially vulnerable, with approximately 2,000 instances likely already compromised—a decrease from around 44,000 earlier in the week. Hackers have been using the bug to gain full control of the affected servers, sometimes deploying ransomware as evidenced by messages displayed on compromised sites. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability, tracked as CVE-2026-41940, to its Known Exploited Vulnerabilities catalog and urged government agencies to patch affected systems immediately. KnownHost detected attacks as early as February, suggesting that exploitation may have begun well before the public disclosure. Despite the severity, the company behind cPanel and WHM, Webpros, has not com