cPanel CVE-2026-41940: 44,000 Servers Compromised — What Companies on Shared Hosting Need to Do Now

Managed hosting without cPanel lock-in — sovereign in Germany — WZ-IT handles concept, migration and operations on our own infrastructure. Open-source stacks (NGINX, Caddy, WordPress), private cloud on Hetzner, CVE monitoring included — patches in hours, not weeks, with NIS2-compliant documentation. Book a kickoff call · CVE monitoring · Managed server operations

A cPanel vulnerability that has been actively exploited since 23 February 2026 is officially disclosed on 28 April 2026. By 5 May, more than 44,000 servers are compromised; around 1.5 million WHM instances remain internet-exposed. A threat-actor group active since 2020, called Mr_Rot13, uses the bug to deploy a six-year-old Go-language backdoor called Filemanager. In parallel, the .sorry ransomware encrypts 8,859 hosts per Censys data; 7,135 of them are cPanel/WHM systems. Germany's CERT-Bund issues an official warning. Ten days later, on 7 May 2026, cPanel announces a second emergency TSR with three more CVEs — patches available since 8 May.

This is not the first cPanel incident of this kind, and it won't be the last. The structural question behind two emergency disclosures in ten days is this: how long is a monolithic hosting-panel daemon running with root on internet-facing ports still tenable? The large US hosters — hosting.com, Namecheap, KnownHost, HostPapa, InMotion — assumed the worst on 28 and 29 April and pre-emptively blocked WHM ports at the edge firewall. watchTowr CEO Benjamin Harris summarises the response bluntly: "the alternative was watching their entire customer base get owned in real-time."

This piece sorts out what happened, how the attack works technically, what to do immediately, and what alternatives exist for companies that no longer want their web presence sitting on a cPanel shared setup.

Table of contents

• CVE-2026-41940 — the trigger
• How the attack works technically
• Two months of zero-day — the timeline
• Mr_Rot13 and the parallel actors
• 8 May — three more CVEs in ten days
• Update of 12 October 2026
• The structural question: monolithic legacy hosting software
• Immediate actions for server operators
• What are the alternatives?
• NIS2 and personal director liability
• Our approach at WZ-IT
• Further reading

CVE-2026-41940 — the trigger

On 28 April 2026 at 12:05 CST, cPanel publishes the advisory for CVE-2026-41940. CVSS 9.8 per NVD v3.1, CVSS 9.3 per v4. Class: CWE-306 (Missing Authentication for Critical Function). Specifically, an authentication bypass in the session-handling code of the cpsrvd daemon — the central web daemon that serves both the customer cPanel UI and the WHM admin UI on ports 2082 through 2096 across every cPanel/WHM install.

The vulnerability is not subtle. A single crafted Basic Authentication header with embedded CRLF sequences is enough to write a session file with arbitrary contents — including user=root and tfa_verified=1. Put differently: anyone can authenticate as root on an unpatched WHM server without knowing any credential whatsoever, and two-factor authentication is bypassed in the same step.

The watchTowr Labs analysis from 29 April puts the reach plainly: "tens of thousands of servers managing a meaningful chunk of the internet." Rapid7 and Shodan data peg the number of internet-exposed cPanel instances worldwide at around 1.5 million — with roughly 70 million managed domains and a 22 to 23 percent market share among commercial hosting panels (Datanyze), this is not a niche issue.

CISA adds the bug to the Known Exploited Vulnerabilities catalog on 30 April 2026, flags known ransomware use and sets a US federal patch deadline of 3 May 2026, i.e. three days. Germany's CERT-Bund follows with its own warning. The BSIG does not set a fixed patch deadline from such a warning: Section 30 BSIG requires appropriate, proportionate and effective measures that should follow the state of the art. A publicly warned, actively exploited flaw without a documented response is still hard to justify in an audit. Correction of 12 October 2026: an earlier version spoke of a response window starting with publication in the authority feeds; the act provides for no such deadline.

How the attack works technically

The core of the bug is an unusually elegant chain of two design flaws in cpsrvd.

First — pre-auth session file. The daemon writes the session file before authentication, not after. This is historical: cPanel has always used file-based sessions, and for certain internal routines (captcha tracking, brute-force protection) the server needs a session shell before it knows who is calling. Under normal conditions, the shell is overwritten later with real auth data.

Second — caller-side sanitisation instead of centralised cleanup. The CRLF filtering of inputs was not implemented inside the saveSession() function itself, but was invoked individually by every caller. Exactly one of those callers forgot. Exactly that one path is reachable from the outside — before authentication — through a crafted Basic Auth header.

The exploit consists of these steps, in this order:

1. CRLF injection into an Authorization: Basic … header. The value is base64-decoded, split into username:password, and partially written into the session file. Anyone who has injected \r\n writes their own lines into the session file — key-value pairs of their choice.
2. Cookie trick to bypass encryption. cPanel session cookies are normally encrypted; the daemon skips decryption, however, for malformed cookies. A purposefully malformed cookie supplies the unencrypted session ID matching the just-written file.
3. Promotion to root. user=root and tfa_verified=1 get injected into the session file. On the next request with the same cookie, the daemon reads the file, sees a "valid" root session with "completed" 2FA, and treats the caller accordingly.
4. Unauthenticated remote root. From here, the attacker has access to the entire WHM API with root rights: creating hosting accounts, modifying every customer site, shell access via cPanel terminal, read access to every hosted database, and to every mailbox spool.

The saveSession() routine has been centralised in the patched versions; CRLF cleanup is now part of the function itself. Architecturally that solves the immediate case, but it doesn't change the underlying pattern — a single daemon process with root privileges on ports 2082 to 2096, accreted since 1996.

Two months of zero-day — the timeline

The vulnerability did not become acutely dangerous on 28 April. Multiple vendors' telemetry tells a consistent story:

• 23 February 2026 (estimated): First in-the-wild exploitation. Multiple independent telemetry sources — XLab/QiAnXin and Help Net Security cite the same date — put the earliest confirmed exploitation on 23 February.
• 28 April 2026, 12:05 CST: cPanel releases the official advisory with patches for every supported branch. Servers with auto-update enabled receive the patch within hours; those on manual update strategies do not.
• 28 April 2026, later that day: Hosting providers hosting.com, Namecheap, KnownHost, HostPapa and InMotion pre-emptively block WHM ports 2083 and 2087 at their edge firewall. watchTowr CEO Benjamin Harris comments: "the alternative was watching their entire customer base get owned in real-time."
• 29 April 2026: watchTowr Labs publishes a full root-cause analysis with proof-of-concept. CERT-Bund warning issued.
• 30 April 2026: CISA adds CVE-2026-41940 to the KEV catalog.
• 3 May 2026: CISA federal-agency patch deadline.
• 5 May 2026: Censys counts 44,000 cPanel servers carrying Mr_Rot13's "Filemanager" backdoor indicators. 7,135 of them additionally carry the .sorry ransomware extension.
• 7 May 2026: Second TSR pre-disclosure with three more CVEs (CVE-2026-29201/29202/29203).
• 8 May 2026, 12:00 EST: Patches for the second TSR series shipped (cPanel/WHM 11.136.0.9 plus backports to older branches).

The zero-day window is therefore around two months. If you ran your own WHM server with open ports 2083/2087 during that period, you have to assume potential compromise — not as fault, but as the basis for forensic review and credential rotation.

Mr_Rot13 and the parallel actors

By far the most interesting threat-actor story behind the mass compromise is Mr_Rot13. The group was named publicly by XLab/QiAnXin researchers and has been active since at least 2020 — roughly six years. XLab rates the detection rate over this period as "extremely low" and describes them, with deliberate caution, as a "highly disciplined cyber espionage or organized cybercrime group."

What the group deploys after CVE-2026-41940 is a cross-platform backdoor called Filemanager. Written in Go, statically linked, runs on Linux, Windows and macOS — on all common architectures. Three properties are operationally noteworthy:

• Web GUI for file management and remote command execution. The backdoor exposes its own web interface on a configurable port, from which the attacker accesses the file system remotely and runs commands.
• bcrypt-based authentication. The backdoor itself protects against unauthorised third-party use — no plaintext password on the wire, but bcrypt hashes. Operational security at a level rarely seen in mass-compromise campaigns.
• Structured data exfiltration. Bash history, SSH keys, device information, database passwords, cPanel virtual aliases (mail-forwarding configurations that map addresses to recipients).

The C2 domain is wrned[.]com — a deliberately misleading variant of "warned." Payloads are partly fetched from wpsock[.]com. XLab also identified a Telegram channel called "0xWR" through which the group (per telemetry, a three-person operation) extracts data.

Mr_Rot13 is, however, not the only actor. Help Net Security has documented at least five operations running in parallel:

• "Sorry" ransomware — a Go-language Linux encryptor with the .sorry file extension and a Tox contact for ransom negotiation. Censys scans count 8,859 hosts with .sorry files; 7,135 are cPanel/WHM systems.
• cPanelSniper — a mass-exploit tool distributed as a proof-of-concept that automates scanning and exploitation.
• Mirai variants — classic botnet recruitment that ropes compromised servers into DDoS swarms.
• Cryptocurrency miners — opportunistic Monero XMR miners as a second payload after successful initial access.
• Ctrl-Alt-Intel espionage actor — connections to Indonesian defence training portals and Chinese railway data; the geographic spread of targets suggests state-aligned motivation.

The attacker IPs cluster, per IT-Boltwise, primarily in Germany, the United States, Brazil and the Netherlands — Germany features prominently both as a source and as a target.

8 May — three more CVEs in ten days

On 7 May 2026, cPanel sends out its second emergency TSR pre-disclosure inside ten days. Three additional CVEs go public on 8 May at 12:00 EST:

Patch: cPanel/WHM from 11.136.0.9 (plus backports to older branches). Active exploitation of the new three is not yet confirmed at disclosure time — but on a platform whose April authentication bypass is not yet plugged everywhere, that is a question of days, not weeks.

The Panelica analysis of the second TSR puts the structural problem dryly: "Two emergency TSRs in ten days is not a statistical anomaly. It reflects the ongoing security cost of running monolithic, legacy-architecture hosting software on internet-facing infrastructure at scale."

That is the point the hosting industry is currently debating internally — and that most end customers have not yet heard about.

Update of 12 October 2026

• More patched branches. Besides the versions listed above, the NVD lists fixes for branches 86 (11.86.0.41), 124 (11.124.0.35) and 130 (11.130.0.19). Anyone running one of these older branches needs at least these versions.
• LiteSpeed cPanel plugin exploited. Many cPanel servers run the LiteSpeed plugin. CVE-2026-48172 (CVSS 9.8) lets any cPanel user account run scripts with root privileges; CISA has listed it in the KEV catalog since 26 May 2026, and LiteSpeed recommends at least plugin version 2.4.7. CVE-2026-54420 (symlink flaw on CloudLinux/CageFS systems) has been in the KEV catalog since 15 June 2026 and is fixed in cPanel plugin 2.4.8 and WHM plugin 5.3.2.0.
• May TSR without known exploitation. As of 12 October 2026, CVE-2026-29201, CVE-2026-29202 and CVE-2026-29203 are not in the KEV catalog. The CVSS values in the table above come from CISA; cPanel itself rates CVE-2026-29201 at 8.6 (CVSS 3.1) and the other two at 5.3 (CVSS 4.0).

The structural question: monolithic legacy hosting software

cPanel launched in 1996. The codebase has accreted since then — Perl, PHP, shell scripts, later C components, a Web-1.0-style admin UI, a REST API on top, a reseller model, virtual mail servers, DNS management, backup integration, WordPress toolkit. All inside a single daemon process (cpsrvd) running as root, listening on public ports. The architecture is not "badly designed" — it has grown organically over three decades and carries the weight of that history.

Three structural consequences of this history are visible in the current incident:

First — pre-auth code paths run as root. The cpsrvd daemon has to read every incoming request, write session shells, increment captcha counters, manage rate limits — all before it knows who the caller is. Every code path in that pre-auth region runs as root. A single forgotten sanitisation, as in CVE-2026-41940, is enough for full compromise.

Second — service mesh without privilege separation. A modern architecture would decompose auth, session management, backup, mail, DNS and WordPress into separate processes with minimal privileges, connected through local sockets or a service mesh. cPanel and comparable legacy panels (Plesk has structurally similar problems) keep all of it inside the same process or under the same uid.

Third — mindshare erosion is accelerating. PeerSpot data shows the cPanel mindshare among hosting buyers falling from 19.9 percent in October 2024 to 12.1 percent in January 2026 — a loss of around 40 percent in 15 months. The platform remains dominant with about 23 percent installed base among commercial panels, but the growth curve has turned. Anyone planning a new hosting architecture today usually plans without cPanel.

That is the actual context of the recent incidents. One bug would be manageable; two in ten days becomes a pattern.

Immediate actions for server operators

If you operate your own cPanel or WHM server — as a hoster, as a reseller, or as a company with your own platform — work in this order:

1. Check the patch level.

/usr/local/cpanel/cpanel -V

Patched versions per branch:

2. Apply a force update.

/scripts/upcp --force
/scripts/restartsrv_cpsrvd

If auto-update is enabled, the patch is usually already applied — verify anyway, since auto-update can silently fail on licensing issues or I/O pressure.

3. If patching is not immediately possible.

# Firewall — block ports (nftables example)
nft add rule inet filter input tcp dport { 2082, 2083, 2086, 2087, 2095, 2096 } drop

# Or stop services
/scripts/restartsrv_cpsrvd --stop
/scripts/restartsrv_cpdavd --stop

Concretely, block the full cPanel daemon port range (2082/2083 = user cPanel, 2086/2087 = WHM, 2095/2096 = webmail). For pure web hosting, Apache/LiteSpeed on 80/443 remains reachable.

4. Check for indicators of compromise.

• Run cPanel's own detection script (linked from the official advisory) — checks for known persistence mechanisms.
• Use the watchTowr detection tool (GitHub) — tests vulnerability non-destructively from the outside.
• Look for the Mr_Rot13 backdoor: unusual processes from /tmp or /var/tmp with Go binary signatures, unusual listening ports, persistent cron jobs referencing wrned.com or wpsock.com.
• Check bash history manipulation and new SSH keys in /root/.ssh/authorized_keys.

5. If compromise is suspected.

• Clean reinstall from a pre-February backup is the only safe path, since the backdoor may persist in unknown locations.
• Rotate every credential: root password, every customer cPanel password, every database password, SSH keys, API keys, FTP passwords.
• GDPR notification to the responsible supervisory authority without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to data subjects (Art. 33 GDPR); if a high risk is likely, data subjects must also be informed (Art. 34 GDPR). For NIS2 entities, additional BSI reporting.
• Forensics: preserve logs, capture memory dumps, bring in an external incident responder if your own capacity is insufficient.

What are the alternatives?

The "alternative to cPanel" discussion has two layers: tactical (different panel) and strategic (different hosting model).

Tactical — alternative hosting panels

• Hestia Control Panel — open-source fork of VestaCP, actively maintained, much leaner codebase, mail/DNS/backup integrated. A realistic alternative for resellers who want to keep the panel model.
• ISPConfig — established German open-source panel, often used at web agencies with their own server fleets.
• Froxlor — open source, comparatively lean, good for smaller setups.
• CloudPanel — from Germany, focused on performance (NGINX instead of Apache), free to use, clean architecture.
• Plesk — proprietary alternative, same architecture family as cPanel, also with a vulnerability history, but commercially better supported.

If you run Plesk in production with high load requirements or agency workflows, our managed server operations on dedicated hardware with managed Plesk fits well — we handle Plesk maintenance, CVE monitoring and hardening as standard.

Strategic — hosting models without a panel

For many companies, the real answer to cPanel incidents is not "different panel" but "no panel." That comes in several flavours:

• Directly managed LAMP or LEMP stack on your own VM at an EU hoster. NGINX or Caddy as the web server, Let's Encrypt certificates fully automated, WordPress or another CMS installed directly. No internet-exposed panel software. Maintenance via Ansible playbooks or a managed service.
• Container hosting on Coolify — open-source PaaS, self-hostable, deploys individual apps in Docker containers, web UI for deploy management. Architectural benefit: the Coolify daemon and a WordPress container are separated; a bug in the panel does not automatically compromise every site.
• Static sites with a headless CMS — Gatsby, Astro, Hugo or Next.js as the generator, content out of a decoupled CMS, delivered via CDN or a plain NGINX instance. Smallest attack surface, best performance.
• Private cloud on Proxmox at Hetzner or netcup — one VM per workload, clear privilege separation, no shared tenancy between customers, full root access for audit and forensics.

For pure WordPress hosting needs, the direct jump to managed WordPress with cleanly separated containers is often more sensible than a panel setup. Migration from a cPanel shared hoster to such a setup, with DNS switch and mail migration, is typically a weekend project — provided someone owns the choreography.

NIS2 and personal director liability

Germany's NIS2 transposition act touches the concrete cPanel case in three places:

Article 21 — cybersecurity risk management. Patch management, response to known vulnerabilities, documented response processes, supplier risk management (also for the hosting provider). Anyone running a compromisable cPanel server in scope without a documented patch workflow and without demonstrable response to the CERT-Bund warning of 29 April has a problem in the audit.

Article 23 — notification obligations. Early notification within 24 hours and a full report within 72 hours for any "significant" security incident. Mass compromise via CVE-2026-41940 with data exfiltration crosses the threshold once customer mail spools or database contents have been extracted.

Liability. Fines against the entity of up to 10 million euros or 2 percent of worldwide annual turnover (Section 65 BSIG). Management is liable to the company for culpably caused damage (Section 38 (2) BSIG), a civil-law internal liability. Anyone who can demonstrate that a documented patch workflow existed and was triggered on time in the specific case is in good shape in the audit. Anyone who cannot is not.

GDPR notification duties run in parallel on data exfiltration. A compromised cPanel instance that hosted personal data - customer records from client systems, mail accounts with plaintext passwords, webshop databases - usually triggers the notification duty under Art. 33 GDPR: without undue delay and where feasible within 72 hours, unless the breach is unlikely to result in a risk to data subjects. If a high risk is likely, data subjects must be informed without undue delay under Art. 34 GDPR.

Our approach at WZ-IT

We offer managed hosting without cPanel lock-in along several paths — depending on what makes sense for your use case:

Managed hosting on our own infrastructure in Germany. Open-source stack: NGINX or Caddy as the web server with automatic Let's Encrypt renewal, WordPress or another CMS directly on the VM or containerised, mail via a separately managed mail server. No panel daemon running as root on internet-exposed ports.

Private cloud on Proxmox at Hetzner or netcup. One VM per workload, clear privilege separation, EU hosting for GDPR compliance, backup architecture with pull-based offsite replication for ransomware safety. Documented RTO/RPO, regular restore tests.

Plesk on dedicated hardware for agencies. Via our managed server operations — for hosting setups managing 50 to 500 domains where the panel model still makes organisational sense. Plesk maintenance, CVE monitoring, hardening and WordPress toolkit management are entirely in our scope.

CVE monitoring as standard. Daily checks against NVD, CISA KEV, BSI advisories and vendor feeds. CVE-2026-41940 would have been mitigated for our customers within hours of the 28 April disclosure — either by immediate patching or by port blocking pending verification. Every response is documented as an attachment to the NIS2 risk-management dossier.

Migration from cPanel shared hosting. DNS-switch choreography, mail migration (IMAP takeover or mailbox sync), parallel transition phase, cleanup of the old environment. A typical SMB site with 5 to 15 mail accounts migrates in two to five working days, with no meaningful downtime.

In the bleeding-edge case. If you currently sit on a cPanel server suspected of compromise, do not just patch it. Take it out of production, restore a pre-February-2026 backup and start the migration to a modern hosting environment in parallel. We handle the cutover logistics so that no continuous downtime occurs.

Further reading

• CWPdoor: check for the Control Web Panel backdoor - the same target class of hosting panels, indicators and check commands
• Managed Services on Your Own Infrastructure (BYOI) — hosting operations without vendor lock-in, on your hardware or ours
• Managed server operations — when the panel model remains organisationally necessary
• CVE monitoring as a managed service — automated response to NVD, CISA KEV and BSI feeds
• Private cloud on Proxmox — alternative to shared hosting with clean VM separation
• Proxmox on Hetzner — sovereign EU hosting baseline with predictable cost structure
• Outsource Hetzner server maintenance — what managed operations actually delivers
• Cisco ASA, ArcaneDoor & CVE-2025-20362 — a modern VPN stack — the same pattern at the edge
• Bleeding Llama (CVE-2026-7482) — the same pattern in self-hosted AI
• Linux kernel vulnerabilities 2026 — patch management at board level — NIS2 context and personal director liability
• Coolify CVE Security Vulnerabilities Update 2025/2026 — what secure container PaaS looks like

Do you operate a website or a server under cPanel or Plesk — and are unsure after the last two weeks whether patches and hoster trust are still a viable strategy? We review your current architecture free of charge and deliver a concrete migration recommendation with effort estimate and compliance assessment — flat rate per site or per server, with or without a parallel transition phase.

Book a free hosting architecture review · Managed Services BYOI · CVE monitoring

Sources

• NVD: CVE-2026-41940
• CISA KEV: CVE-2026-41940
• watchTowr Labs: cPanel/WHM Authentication Bypass
• NVD: CVE-2026-29201, CVE-2026-29202, CVE-2026-29203
• LiteSpeed: Security Update for LiteSpeed cPanel Plugin (May 2026)
• LiteSpeed: Security Update for LiteSpeed cPanel Plugin (June 2026)
• NVD: CVE-2026-48172 and CVE-2026-54420
• GDPR, Regulation (EU) 2016/679, Art. 33 and 34
• BSIG Section 30: Risk management measures (German)
• BSIG Section 38: Duties of management (German)