cPanel and WHM Servers Targeted in Attacks Exploiting CVE-2026-41940

A critical CVE-2026-41940 authentication bypass in cPanel/WHM is being actively exploited by a sophisticated actor called Mr_Rot13 to gain full administrator access, deploy Go-based payload injectors and a persistent cross-platform 'filemanager' remote control Trojan, harvest credentials via injected JavaScript, implant SSH keys and webshells, and exfiltrate sensitive data (reported 4 GB from Southeast Asian government/military networks); the report provides technical TTPs and IOCs including MD5 hashes and a defanged C2 domain.