CVE-2026-41940 cPanel Authentication Bypass Mass-Exploited Since February 2026; 8,800+ Servers Confirmed Encrypted, Mirai Botnet Variants Deployed

CVE-2026-41940 — a CVSS 9.8 pre-authentication bypass in cPanel/WHM exploited as a zero-day for roughly two months before the April 28 patch — continues to generate active compromise across an estimated 1.5 million exposed instances, with Censys identifying 8,859 hosts serving open directories of .sorry-extension encrypted files consistent with the Go-based Linux encryptor deployed in the campaign. The exploit chain (CRLF injection in the session writer promoting a pre-auth session to full WHM root access) is publicly available via watchTowr Labs, and a parallel campaign by group Mr_Rot13 implants credential-harvesting JavaScript in cPanel login interfaces alongside SSH backdoors labeled 'cpanel-updater'. Shadowserver tracked over 44,000 unique cPanel IPs scanning or exploiting at peak; a separate Mirai variant (nuclear.x86) is leveraging compromised hosts for DDoS infrastructure and cryptomining.

Shadowserver tracked over 44,000 unique cPanel IPs scanning or exploiting at peak; a separate Mirai variant (nuclear.x86) is leveraging compromised hosts for DDoS infrastructure and cryptomining.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.