Hackers Abuse CVE-2026-41940 to Take Over cPanel and WHM Servers

## Executive Summary A critical CVE-2026-41940 authentication bypass in cPanel/WHM (CVSS 9.8) is being actively exploited worldwide to gain unauthenticated administrator access; the actor tracked as “Mr_Rot13” deploys an AI-like Go injector, SSH backdoors, a PHP webshell (“Cpanel-Python”), injected JavaScript credential-stealers, and a cross-platform Filemanager RAT to enable ransomware, cryptomining, and data exfiltration (including reported thefts of sensitive archives). Defanged domains and MD5 hashes are listed as IOCs; large-scale automated scanning and exploitation have been observed.