The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) shared a critical alert late last week, warning of hackers actively targeting Australian organisations via a critical vulnerability impacting cPanel & WHM and WP Squared products.
“ASD’s ACSC is aware of active exploitation in Australia of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products,” the ACSC said in a 1 May critical alert.
“The vulnerability is an authentication bypass, which can allow unauthenticated remote attackers to gain access to the control panel, as well as conduct remote code execution (RCE).”
The vulnerability – first disclosed by cPanel on 26 April – has a CVSS score of 9.8 and affects all versions of cPanel after 11.40, which dates back to 2013. A patch is available as of 30 April.
According to cyber security firm Rapid7, exploitation of CVE-2026-41940 may date back several months.
“A managed cPanel host, KnownHost, stated that CVE-2026-41940 is actively being exploited in the wild, with speculation of targeted zero-day exploitation happening as early as February 23, 2026, prior to the vulnerability’s public disclosure,” Rapid7 said in a blog post last updated on 1 May.
“Successful exploitation of CVE-2026-41940 grants an attacker control over the cPanel host system, its configurations and databases, and websites it manages. A naive Shodan query for potential targets returns approximately 1.5 million cPanel instances exposed to the internet that may be vulnerable.”
Benjamin Harris, CEO and founder of watchTowr, said the vulnerability impacts a “meaningful chunk of the internet” and that many providers were scrambling to address the issue.
“Within hours of the advisory dropping, nearly every major hosting provider on the planet had firewalled their own customers off their own product. hosting.com, Namecheap, KnownHost, HostPapa, InMotion, and the rest all pulled the emergency brake because the alternative was watching their entire customer base get owned in real-time,” Harris said.
“Once again, we’re running around with half the internet seemingly ablaze, and given the increased usage of AI in vulnerability research, we anticipate this new normal to become increasingly familiar.”
You can read watchTowr’s full analysis here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.