cPanel authentication bypass exploited in wild since February
Critical vulnerability CVE-2026-41940 in cPanel, WHM, and WP Squared is under active exploitation with public proof-of-concept code now available.
A critical authentication bypass vulnerability in cPanel and Web Host Manager (WHM) has been exploited as a zero-day since late February, according to BleepingComputer. The flaw, tracked as CVE-2026-41940, also affects WP Squared and allows attackers to circumvent authentication controls.
The vulnerability has been actively leveraged in attacks for at least two months before public disclosure. Proof-of-concept exploit code is now publicly available, lowering the barrier for additional threat actors to weaponize the flaw.
cPanel and WHM are widely deployed control panel systems used by hosting providers and enterprises to manage web servers, domains, and email accounts. An authentication bypass in these platforms grants attackers administrative access to server infrastructure, customer data, and hosted websites. WP Squared, a WordPress management tool integrated with cPanel, is similarly affected.
- 01Hosting providers and enterprises using cPanel must patch immediately or face administrative takeover.
- 02Customers of affected hosting providers may experience data exposure or service disruption.
- 03Public PoC availability will accelerate exploitation attempts across unpatched infrastructure.
Multi-Year Phishing Campaign Compromises Over 500 Organizations
A sustained phishing operation has breached more than 500 entities across aviation, energy, logistics, and critical infrastructure over several years.
JDownloader site compromised to distribute Python RAT malware
Popular download manager's official website served malicious Windows and Linux installers this week, deploying remote access trojan to unsuspecting users.
Linux zero-day grants root access across major distributions
Dirty Frag exploit enables local privilege escalation with a single command, affecting most enterprise Linux deployments currently in production.