First reports come in of victims of critical cPanel vuln as 'millions' of sites potentially exposed

CISA added a critical cPanel/WHM vulnerability (CVE-2026-41940, CVSS 9.8) to its Known Exploited Vulnerabilities list after evidence of active exploitation; vendors released a patch but hosting providers reported exploitation attempts and at least one alleged ransomware attack, while Rapid7/Shodan identified roughly 1.5 million internet-exposed cPanel instances, making immediate patching and access restriction urgent.