CVE-2026-41940: The cPanel Authentication Bypass That Runs 70 Million Domains and Is Being Weaponized Right Now
- Created
- 4 May 2026
- Last reply
- 6 months ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article CVE-2026-41940: The cPanel Authentication Bypass That Runs 70 Million Domains and Is Being Weaponized Right Now.
CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel/WHM affecting every version after 11.40. It was a zero-day for two months, 44,000 IPs are now scanning, ransomware has deployed, and a state-linked actor is hitting Southeast Asian government networks. Patch now.
Discussion thread — share findings, corrections and follow-ups below.