Bug of the year (so far): Nasty cPanel vulnerability probably exploited as a 0-day

A critical CRLF input-sanitization vulnerability (CVE-2026-41940, CVSS 9.8) in cPanel and WHM allows attackers to create a session cookie from a failed login and send a crafted header to escalate privileges to root, effectively bypassing authentication; it potentially affects all supported, unpatched versions and services relying on cPanel (estimated reach: millions of domains). Emergency patches and vendor/third-party detection scripts are available and administrators are urged to patch immediately and scan for signs of compromise.