Agentum Cloud
Agentum

Sourced writing from Agentum R&D

Enterprise-Grade, Explained · For business owners

cPanel CVE-2026-41940 explained: was your web host hit?

By Agentum R&D · 7 min read
Published · Updated

Short answer cPanel is the control panel many web hosts use to run customer sites. In April 2026 a flaw let attackers bypass its login, and reports say it was exploited from February, before the 28 April fix. If you use shared hosting, ask your host when it applied the fix.

When you log in to manage your website, email or files, there is often a screen called cPanel. It is a control panel: a dashboard that many web hosting companies run on their servers, so customers can manage a site without being technical. Its sister screen, WHM, is the host’s own side, where the company runs every customer account on a server.

In April 2026, researchers found that the login to that control panel could be bypassed, and gave the flaw the catalogue number CVE-2026-41940. An attacker did not need a password to reach WHM, the screen that runs everything on the serverSource 1. Help Net Security reports attackers were using it from February, two months before the fixSource 2.

If your website lives on shared hosting, a cheap plan where one server holds many customers’ sites, you may be affected without ever having logged in to cPanel. You cannot patch it yourself. The one thing to do is ask your host when the fix for your server’s version was applied; for current versions it was 28 April 2026. A short check of your own account follows below.

What was found, and what an attacker gets

watchTowr, a security research firm, published its analysis on 29 April 2026. Its summary: the bug lets an attacker slip past the login and reach the administrator screen, and from there take administrator-level control of the server, which also means every website on itSource 1. The scale is large: watchTowr writes that, depending on who you ask, the software runs “somewhere north of 70 million domains”Source 1.

The vendor’s own account is on cPanel’s blog. cPanel says it confirmed the flaw on 27 April and released security updates on 28 April for its main version lines, with updates for older versions following, and that every version after 11.40 was affectedSource 3. The severity score is 9.8 out of 10; cPanel says VulnCheck, a security company, assigned it, and Rapid7, another, reports the sameSource 3.

On timing, be careful. Help Net Security, a security news site, reports attackers were spotted exploiting it since 23 February. Rapid7 calls exploitation from that date speculation. Neither names who saw it or what it hitSource 4. Treat February as reported, not proven.

How a careful count became “44,000 servers compromised”

Search for this bug and you will find the number 44,000. It appears in headlines. Here is who said what.

The Shadowserver Foundation is a nonprofit that watches internet attacks. It runs honeypots: decoy servers that exist only to record who attacks them. Its own post of 1 May, embedded in Security Affairs, said attacks were ongoing “with at least 44K IPs likely compromised” seen scanning its honeypots on 30 AprilSource 5. An IP address is a number that identifies a machine on the internet; it is not a website and not necessarily a server.

A follow-up from the same account explained the count: it is based on a spike of devices seen scanning, running exploits or brute-forcing its decoysSource 5. Help Net Security reports the same figure that way, plus about 650,000 addresses hosting cPanel or WHM that can be reached from the internetSource 2.

Then the hedge fell off. On 2 May, CyberInsider ran the headline “Massive cPanel campaign compromised 44,000 servers worldwide”Source 6. It dropped “likely” and “at least”, and its headline counted servers where Shadowserver counted addresses. Shadowserver’s reading is that these are likely hacked machines; no source says how many are confirmed. It is an estimate of victims built from attackers seen, not a count of them.

Three numbers that get mixed up: 44,000 IP addresses seen attacking Shadowserver honeypots, which Shadowserver called likely compromised, with no confirmed count; about 650,000 addresses hosting exposed cPanel; about 1.5 million exposed instances in a Shodan search per Rapid7. None counts hacked websites. Timeline: 23 Feb reported first exploitation, 28 Apr fix, 30 Apr CISA list.
Image description

Title: Three cPanel numbers, three different things. Subtitle: CVE-2026-41940, April 2026. None of them counts hacked websites. Box 1: 44,000 IP addresses. Shadowserver saw them scanning, running exploits or brute-forcing its honeypots, which are decoy servers, and called them likely compromised. A CyberInsider headline called them 44,000 compromised servers. Label: Seen attacking; Shadowserver says likely hacked; confirmed count not given. Box 2: about 650,000 addresses. Shadowserver saw cPanel or WHM reachable from the internet. Label: Reachable, not hacked. Box 3: about 1.5 million instances. Rapid7 found them with a basic Shodan search; they may be vulnerable, with no confirmed count. Label: Possible, not confirmed. Timeline: 23 February 2026, earliest reported exploitation (likely older, per Help Net Security; Rapid7 calls it speculation); 28 April, cPanel releases the fix; 30 April, CISA adds the flaw to its list of exploited bugs (cPanel says 1 May). Green box: What matters to you is whether your host applied the fix for your server on time, not which number is biggest.

What each cPanel number counts. None of them is a count of websites that were taken over. Sources: Shadowserver posts via Security Affairs and Help Net Security; Rapid7; CyberInsider; Canadian Centre for Cyber Security; cPanel blog.

The other big number has a different problem. Rapid7 says a basic search of Shodan, a site that catalogues internet-connected devices, finds about 1.5 million cPanel instances reachable from the internet that “may be vulnerable”, with no count of confirmed vulnerable hostsSource 4. Shadowserver’s 650,000 is a different count of the same idea. Neither counts hacked websites, and we found no source that does.

Early on, the web host KnownHost’s CEO told customers he had seen only access checks on his network. By 5 May, Help Net Security was reporting that the probing had grown into exploitation by multiple groupsSource 2. One host’s early calm is not a total.

How fast cPanel fixed it, and what its critics say

cPanel says builds were ready about 28 hours after it confirmed the flaw, that over 98% of servers worldwide ran an updated version by 10 May, and that an earlier report in April could not be reproduced, so its initial assessment did not confirm a vulnerabilitySource 3. The 98% is the vendor’s own figure. One source quoted by Help Net Security claims the bug was reported about two weeks before 28 April and that cPanel first said nothing was wrongSource 2.

This changes the question. cPanel says over 98% of servers were updated by 10 May. What matters is whether yours was hit before it was.

CISA called it exploited; cPanel published a detection script

CISA, the US government’s cyber-defence agency, keeps a list of flaws known to be used in real attacks, called the Known Exploited Vulnerabilities catalog. The Canadian Centre for Cyber Security’s advisory records CISA adding this one on 30 April; cPanel’s own post says 1 MaySource 7. CISA’s own pages refused to load for us. Security Affairs reports federal agencies had until 3 May, from a page with visible errorsSource 5. Either way, a flaw on that list is used in real attacks.

For servers that could not be updated at once, cPanel recommended blocking the service port and applying ModSecurity rules (a web-request filter). It also published a script that looks for signs of intrusion, and says to run it on any server that was unpatched during the incident windowSource 3. Updating closes the door but does not tell you whether someone already walked through.

We tried to read cPanel’s own support article for the update. It returned a 403 error to us, so we relied on cPanel’s blog and on Rapid7 and watchTowr for what it says.

What to ask your host

The useful question on shared hosting is not how many servers were hit. It is whether yours was patched, and how fast. Some hosts blocked the panel’s ports first and patched laterSource 2. “Blocked, not yet patched” is a half-answer. Here is an email you can paste and edit:

Hi, after the cPanel security issue CVE-2026-41940 in April, could you confirm three things about the server our site runs on?
First, the date and time the fix for CVE-2026-41940 was applied to it, for its cPanel version, not only the ports being blocked.
Second, whether the server ran unpatched at any point, and whether you ran cPanel’s detection script on it afterwards, with the result.
Third, whether you have seen any unexpected logins or changes on our account.
Thanks.

A date and “script run, clean” is what you want. “We’re looking into it” with no date is a warning. If you pay for a virtual private server or a dedicated server and run cPanel yourself, you are the host: update it now and run the detection script yourself, or have your IT provider do it.

Look first, change passwords second

These steps are our advice, not an instruction from cPanel. The order matters. The flaw is a login bypass, so an attacker already inside does not need your password; changing it first removes nobody, and deleting things first destroys evidence your host may need.

  1. Look first, change second. Screenshot anything you do not recognise before you delete it. In cPanel, check email forwarders (rules that send a copy of your email elsewhere), FTP accounts, scheduled tasks (cron jobs) and extra users. If you run WordPress, open Users and look for administrators you do not recognise.
  2. Ask your host, and leave what it must see. Use the email above. Do not clean up anything you found until the host has seen it.
  3. Then change passwords, from a device you trust. Start with your email and your hosting login, use a long unique password from a password manager, and turn on two-factor login if offered.
  4. Change the passwords stored on your site. If your host cannot say the server was clean, treat the database password in your site’s settings file and any API keys as readable by an attacker with server access, and replace them.
  5. Confirm you have a backup that is not on the same server. A backup stored only there may be gone if the server is wiped.

If you find something, tell your host in writing and keep the screenshots.

  1. Ask your host when the fix for your server’s version was applied 28 April for current versions; older versions were patched later. Ask whether the detection script ran.
  2. Look first: screenshot forwarders, cron jobs, FTP accounts and admin users you did not create
  3. Then change hosting and email passwords from a trusted device Turn on two-factor login if offered.
  4. Replace database passwords and API keys stored on the site if the host cannot say the server was clean
  5. Treat “44,000 compromised” as an estimate, not a count of victims Shadowserver called those addresses likely compromised; no source gives a confirmed number.

Sources

  1. watchTowr Labs: cPanel & WHM authentication bypass, CVE-2026-41940 (29 Apr 2026). Retrieved . ↩ ↩ ↩
  2. Help Net Security: cPanel zero-day exploited for months before patch release (30 Apr 2026, updated). Retrieved . ↩ ↩ ↩ ↩ ↩
  3. cPanel blog: Security update, CVE-2026-41940 (10 May 2026). Retrieved . ↩ ↩ ↩ ↩
  4. Rapid7: CVE-2026-41940, cPanel & WHM authentication bypass (29 Apr 2026, updated). Retrieved . ↩ ↩
  5. Security Affairs: CISA adds a flaw in WebPros cPanel to its KEV catalog (3 May 2026; embeds Shadowserver posts of 1 May; page has errors). Retrieved . ↩ ↩ ↩
  6. CyberInsider: Massive cPanel campaign compromised 44,000 servers worldwide (2 May 2026). Retrieved . ↩
  7. Canadian Centre for Cyber Security: cPanel security advisory AV26-404 (29 Apr 2026, update 30 Apr). Retrieved . ↩

Published · Updated Report an error (support@agentum.cloud)