Attackers exploit critical vulnerability CVE-2026-41940 in cPanel/WHM
The same actor reportedly used a custom exploit chain against an Indonesian defense training portal after obtaining valid credentials. The attack included, among other things, bypassing CAPTCHA using values stored in session cookies.
According to Security Affairs, a critical vulnerability CVE-2026-41940 in cPanel/WHM is being actively exploited by remote attackers to bypass authentication.
Researchers at watchTowr said the attacks primarily target government and military organizations in Southeast Asia, as well as MSPs and hosting providers in the Philippines, Laos, the United States, Canada, and South Africa.
watchTowr also stated that exploitation of this flaw has been observed in real-world attacks, citing a report from KnownHost. The Shadowserver Foundation warned that there may be thousands of vulnerable cPanel/WHM instances accessible on the internet; however, the exact number has not yet been confirmed.
Ctrl-Alt-Intel detected attacks on 2 May 2026 and linked them to a specific IP address and public PoCs
The group Ctrl-Alt-Intel observed active attacks exploiting CVE-2026-41940 on 2 May 2026, and associated the activity with the IP address 95.111.250[.]175.
According to the researchers, the attackers targeted government and military domains in the Philippines and Laos, as well as MSPs and hosting companies. The attacks reportedly used publicly available PoC scripts watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py and check_session.py. Ctrl-Alt-Intel also identified an exposed 'staging' server used by the attackers, which allowed for more detailed observation of the operation.
The same actor reportedly used a custom exploit chain against an Indonesian defense training portal after obtaining valid credentials. The attack included, among other things, bypassing CAPTCHA using values stored in session cookies.
The attack, the researchers said, also involved SQL injection in a document field and subsequent escalation to remote code execution via a PostgreSQL database, with data exfiltration occurring through the application itself.
Researchers described deployment of AdaptixC2, PowerShell reverse shells, and lateral movement in the network
Researchers observed deployment of the malware payload AdaptixC2, use of PowerShell reverse shells, and persistence and pivoting via OpenVPN and Ligolo. The operation also included deploying custom Linux services to maintain long-term access.
According to Ctrl-Alt-Intel, the attacker then moved laterally into a Chinese network, interacted with internal systems, and stole approximately 110 files totaling 4.37 GB. The stolen data reportedly included technical documents on railway electrification and sensitive personal information, including identification details, banking information, and phone numbers.
Vulnerability allows authentication bypass in cPanel/WHM
The vulnerability CVE-2026-41940 is a critical flaw enabling authentication bypass in cPanel/WHM, affecting versions 11.40 and newer if they have not been updated to the patched builds released by cPanel.
The flaw allows remote attackers to bypass or manipulate authentication mechanisms and gain access to the administrative interface without valid credentials. According to Security Affairs, this can lead to management of hosting settings, access to sensitive data, or potential full takeover of the server.
watchTowr published information about the vulnerability in the week before 4 May 2026 and also released a Detection Artifact Generator tool to identify vulnerable hosts. It also stated that exploitation of the flaw had been observed in active attacks.
Attacks targeted governments, military organizations and hosting companies
According to Security Affairs, the main targets of the campaign were government and military organizations in Southeast Asia, as well as MSPs and hosting providers in the Philippines, Laos, Canada, South Africa, and the United States.
Ctrl-Alt-Intel documented the exfiltration of approximately 110 files totaling 4.37 GB from a Chinese network, including technical documents and personal data.
The Shadowserver Foundation also warned that there may still be thousands of potentially vulnerable cPanel/WHM instances accessible on the internet, but the exact number has not yet been independently confirmed.
The identification of public PoC tools and a specific IP address, according to the researchers, indicates that the disclosed flaw is already being actively and deliberately exploited.
Attribution of the attacks has not yet been confirmed
Ctrl-Alt-Intel did not attribute the campaign to any specific group or state and said that attribution is not confirmed at this time.
Comments in Vietnamese were found in scripts and tools, but researchers cautioned that linguistic traces alone are not reliable evidence of the attackers' origin.
watchTowr published information about the vulnerability in the week before 4 May 2026 and confirmed ongoing exploitation of the flaw. Ctrl-Alt-Intel recorded active attacks as early as 2 May 2026. The Security Affairs article was published by Pierluigi Paganini on 4 May 2026.