cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor

**Executive summary:** The report attributes widespread, active exploitation of cPanel/WHM vulnerability CVE-2026-41940 to a threat actor dubbed Mr_Rot13, who uses automated attacks (over 2,000 source IPs) to deploy a Go-based infector and the Filemanager backdoor that implants SSH keys, drops PHP web shells for credential theft (ROT13-encoded exfiltration to Telegram), and delivers a cross-platform backdoor used for data collection, cryptomining, botnet propagation, and ransomware.