cPanel vulnerability leads to massive hacks

Attackers are widely exploiting a newly disclosed cPanel/WebHost Manager flaw, CVE-2026-41940, to take over unpatched servers and websites.

Monitoring groups said more than 550,000 servers may be vulnerable, though suspected compromises dropped from about 44,000 to 2,000 as some systems were patched or recovered.

CISA added the bug to its actively exploited vulnerabilities list after signs of website defacement and ransomware-like tampering.

The issue is high risk because cPanel powers many hosting environments and exposed servers can be fully controlled by attackers.