Home / Technology / Critical cPanel Flaw Sparks Widespread Attacks
Critical cPanel Flaw Sparks Widespread Attacks
4 May
Summary
- Thousands of websites remain vulnerable to cPanel exploits.
- Hackers exploited a critical flaw allowing full server control.
- Ransomware attacks visible as Google indexed encrypted sites.
Thousands of websites continue to face threats from a critical vulnerability in cPanel and WebHost Manager (WHM) software, nearly a week after its disclosure. As of Monday, an estimated 550,000 servers running cPanel remain vulnerable, with around 2,000 instances showing signs of compromise, a significant decrease from earlier figures. The flaw, tracked as CVE-2026-41940, allows attackers to take complete control of affected servers.
Security researchers first alerted users to the ongoing exploitation on Thursday. Evidence of the attacks includes dozens of websites indexed by Google that had previously displayed ransomware messages claiming files were encrypted. While some sites have since returned to normal operation, the threat persists. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its catalog of known exploited threats and advised government agencies to apply patches by Sunday. Some security firms detected exploitation as early as February 23, suggesting attacks may have preceded the official disclosure.
