Actively exploited cPanel bug exposes millions of websites to takeover

Security researchers are warning about a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM). This is a critical, actively exploited authentication-bypass bug in cPanel/WHM that lets attackers gain administrative access to the interface without credentials, potentially take over servers and all hosted sites. The vulnerability, tracked as CVE-2026-41940 , has been added to the Known Exploited Vulnerabilities catalog by the Cybersecurit