cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor
Summary: A threat actor tracked as Mr_Rot13 exploited CVE-2026-41940, an authentication bypass in cPanel and WebHost Manager (WHM), to deploy a cross-platform backdoor called Filemanager on compromised environments. QiAnXin XLab reported more than 2,000 attacker source IPs worldwide involved in automated attacks on the flaw, which was publicly disclosed late last month and has also been tied to cryptocurrency mining, ransomware, botnet propagation, and backdoor implantation.
What's compelling: The attack chain resets the cPanel root password to a fixed string, plants an SSH key for persistent access, and exfiltrates bash history, SSH data, database passwords, and cPanel valiases to a Telegram group - and XLab says detection rates for Mr_Rot13's samples and infrastructure have stayed extremely low over six years, with the C2 domain in use since at least 2022.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-41940
- Related
- CVE-2026-41940: Web Pros cPanel & WHM and WP2 (Word Press Squared) Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Apr 30, 2026