cPanel and WHM login bypass (CVE-2026-41940): what it means for your hosting
A critical flaw in cPanel and WHM lets an attacker get past the login without a password. It's being used in real attacks, including ransomware, and the Australian Cyber Security Centre has issued an alert. WaTo's hosting servers are patched.
Last updated
The short answer
CVE-2026-41940 is a critical authentication bypass in cPanel and WHM, rated 9.8 out of 10. An attacker can slip extra data into the login process and be treated as logged in, which can give them control of hosting accounts or the whole server. cPanel released fixed builds in April 2026 and the flaw is listed as actively exploited. WaTo's hosting servers are patched. If you're hosted elsewhere, ask your host to confirm the update and to run cPanel's compromise check.
What the flaw is
cPanel is the control panel for a hosting account, and WHM is the panel above it that runs the whole server. The flaw is in how they handle logins. A carefully built login request can be treated as a real one. Because WHM controls every account on a server, a break-in there can reach every website and mailbox on it. Every cPanel version after 11.40 was affected until patched.
Why it matters
It's being used now
Attacks were seen before the fix came out, and working attack code is public.
It reaches the whole server
A WHM break-in can change any website, mailbox or database on that server.
Ransomware groups use it
Some attacks have encrypted or wiped hosting accounts.
Patching isn't the whole job
A server broken into before it was patched can still have a way back in for the attacker. cPanel released a check script for that.
Who this is for
- Businesses with a website or email on cPanel hosting.
- Resellers and agencies running their own WHM server.
- Anyone whose host hasn't said whether they've patched.
What to do now
- Ask your host. Ask whether cPanel on your server has been updated for CVE-2026-41940, and whether they ran cPanel's compromise check.
- Change your passwords. Change your cPanel password and the passwords for email and FTP accounts, especially if you can't get a clear answer from your host.
- Look for changes you didn't make. Check for new email forwarders, new FTP or email accounts, and website files you didn't add.
- Running your own WHM? Update to a fixed build, run cPanel's check script, and limit WHM access to addresses you know.
How WaTo can help
- WaTo's cPanel servers are patched for CVE-2026-41940. Current advisories are on our server status page.
- We manage cPanel and WHM servers for resellers and businesses that run their own, including updates and compromise checks.
- If your host is slow to answer, we'll help you check and, if needed, move.
cPanel vulnerability questions
Is WaTo hosting affected?
Our servers are patched for CVE-2026-41940. The server status page lists current security advisories.
Do I need to do anything if WaTo hosts my site?
Nothing for the patch itself. Changing your cPanel and email passwords from time to time is still good practice.
How do I know if my host is patched?
Ask them for a straight yes or no. A good host will tell you it's done and whether they checked for signs of a break-in.
Is this the same as the PHP vulnerability?
No. This one is in cPanel's login. The PHP flaws from October 2026 (PHP2Shell) are in PHP itself. A hosting server needs both fixed.
How WaTo can help with this
Guides on this topic
- Critical PHP vulnerabilities (PHP2Shell): what it means for your website
- What is cPanel, and do you need it?
- What to do if you've been hacked
Sources & references
WaTo Consulting. Last reviewed 2026-10-23. Review when cPanel or the government updates the advisory.
Worried about your cPanel server?
Give us a call and we'll check where your hosting stands.
Mon to Fri, 8:30am to 5pm
