Hackers are actively exploiting a bug in cPanel, used by millions of websites

Security researchers say CVE-2026-41940, a cPanel/WHM login-bypass flaw, is being actively exploited in the wild.

The bug can expose server administration panels and potentially give attackers full control of hosting servers.

Major providers including Namecheap, HostGator, KnownHost, and WP Squared have blocked access or applied patches.

The Canada cybersecurity agency said exploitation is highly probable, raising urgent concerns for shared hosting security.