Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks
Summary: Ctrl-Alt-Intel detected on May 2, 2026 a previously unknown actor exploiting CVE-2026-41940, a critical authentication bypass in cPanel and WebHost Manager, from IP address 95.111.250[.]175 against government and military domains in the Philippines and Laos plus MSPs and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S., using publicly available proof-of-concepts. The same actor used a custom chain of authenticated SQL injection and remote code execution against an Indonesian defense sector training portal, and used AdaptixC2, OpenVPN, Ligolo, and systemd persistence to exfiltrate a substantial corpus of Chinese railway-sector documents.
What's compelling: Censys found the cPanel flaw weaponized by multiple third parties within 24 hours of disclosure, including Mirai botnet variants and the Sorry ransomware strain, and Shadowserver counted at least 44,000 IP addresses likely compromised via CVE-2026-41940 scanning and brute-forcing its honeypots on April 30, 2026.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-41940
- Related
- CVE-2026-41940: Web Pros cPanel & WHM and WP2 (Word Press Squared) Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Apr 30, 2026