cPanel Critical Authentication Bypass Actively Exploited - CVE-2026-41940

General Discussions
, , ,
1

A handful of servers I manage are affected by this today:

About 1 in every 30 was breached before the patch was in most cases pulled, and some pushed. Others were self-managed, so I only get alerted after the fact lol.

Here’s some grief that attackers have done on exploited servers:

  • Stole password hashes for every user account on the server (these can be cracked offline over time).
  • Stole the MySQL root password and the server’s SSH private keys.
  • Created hidden API tokens that would let them back in even after a password change.
  • Created 10 unauthorized hosting accounts on the server (likely intended for phishing or scam sites).
  • Opened multiple interactive root shells — the contents of what was typed are not logged, so we cannot see exactly what they ran inside those sessions.
  • Likely downloaded a list of the accounts and contact details on the server.

No cool!

3 Likes
2

Another depressing fact was that these exploits were possible because critical management interfaces were open vs restricted to management networks/addresses.

3 Likes
3

Yes, only a few servers online restrict access to the ports in question.

This is affecting as much as 70 million domains:

2 Likes