There was a serious security issue recently disclosed by cPanel involving cPanel & WHM servers worldwide.
On April 28, 2026 at 12:05 PM CST, cPanel published an initial security advisory for CVE-2026-41940, an authentication bypass vulnerability affecting cPanel & WHM systems. This vulnerability is considered critical because it could allow unauthorized access to cPanel/WHM control panels under certain conditions. cPanel has since released security patches for affected systems and advised server administrators to update immediately.
Independent security researchers and cybersecurity news sources have also reported that this vulnerability was serious, widespread, and reportedly exploited in the wild. The Hacker News reported that the flaw carries a CVSS severity score of 9.8 out of 10, and that CISA added it to its Known Exploited Vulnerabilities catalog.
One of our older hosting providers, which we had already moved away from, appears to have been affected by this issue. Thankfully, our active hosting services had already been migrated off that older environment.
At this time, we do not have evidence that our new VPS server was affected. However, out of an abundance of caution, we have taken additional security steps, including changing all cPanel account passwords on the new VPS server.
What We Have Done
We have taken the following precautionary actions:
- Verified that our active client traffic is no longer being served from the older affected hosting environment.
- Confirmed that our new VPS server does not currently appear to show signs of this issue.
- Changed all cPanel passwords as a security precaution.
- Reviewed the situation against cPanel’s published advisory and recommended actions.
- Continued monitoring for any related alerts, unauthorized access, or abnormal account activity.
What This Means for You
At this time, there is no action required from most clients.
However, as a general security precaution, we recommend that you remain alert for suspicious emails, unexpected password reset messages, unusual website behavior, or unfamiliar login notifications.
If you maintain your own website logins, WordPress administrator accounts, email accounts, or third-party services, this is also a good time to make sure you are using strong, unique passwords.
About the Vulnerability
This issue involved cPanel & WHM, the control panel software used by many hosting companies around the world. cPanel stated that the issue affected versions after 11.40 and released patched versions. Their advisory also recommended immediate updates, verification of the installed cPanel version, and restarting cPanel services after patching.
Cybersecurity reporting described the vulnerability as an authentication bypass that could allow unauthorized access to control panel systems. Because WHM/cPanel access can affect many websites on a server, this type of vulnerability is much more serious than a normal single-site issue.
Our Current Status
Our new VPS environment does not appear to have been affected, but we are treating this matter seriously and have already changed all cPanel passwords as a precaution.
The older provider environment that appears to have been affected is no longer carrying our active client traffic.
We will continue to monitor the situation and take any further action needed to protect client websites and hosting accounts.
