cPanel Releases Emergency Patch After Authentication Bypass Ransomware Attack

On May 8, 2026, cPanel released a second emergency security patch following the CVE‑2026‑41940 authentication bypass that was used to compromise 44,000 web hosting servers and deploy ransomware. The patch addresses three new vulnerabilities that could allow attackers to execute arbitrary code, elevate privileges, or bypass authentication controls. cPanel’s security team emphasized that the vulnerabilities were actively exploited and that the patch must be applied immediately to prevent further compromise. The update includes fixes for directory traversal, remote code execution via malformed requests, and a privilege escalation flaw in the WHM interface. Users are urged to update to the latest cPanel version and verify that the new security headers are correctly configured. The patch also adds additional logging for failed authentication attempts to aid in forensic analysis. cPanel recommends running a full audit of server configurations after applying the update.