Archive — US — techcrunch
Hackers are still exploiting the cPanel bug to gain control of thousands ofwebsites
Hackers continue exploiting a critical vulnerability in cPanel and WHM, impacting over 550,000 servers. Despite warnings, approximately 2,000 sites are believed compromised, down from 44,000. The U.S. CISA has categorized the flaw (CVE-2026-41940) as actively exploited, urging urgent updates, while evidence of ransomware attacks has emerged, leaving some victims vulnerable.
Key points
- cPanel and WHM alerted users of a critical flaw a week ago.
- More than 550,000 servers are potentially vulnerable; around 2,000 are compromised.
- The vulnerability allows attackers to control servers via control panels.
- CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog.
- Ransomware messages were displayed on compromised sites, indicating the extent of the attacks.
Why it matters
- Ongoing cyberattacks highlight the importance of software updates and vulnerability management.
- The rise of multi-cloud environments in 2025 makes vulnerabilities in widely-used software like cPanel more critical.
- As more businesses migrate online, incidents like these underscore the risks inherent in digital transformation and the need for robust cybersecurity measures.
The ongoing exploitation of the cPanel flaw underscores the vital need for timely software patching and vigilance against cyber threats in today's rapidly evolving digital landscape.