Hackers are still exploiting the cPanel bug to gain control of thousands of websites

In a concerning development, cybercriminals continue to exploit a significant vulnerability in cPanel and WebHost Manager (WHM) software, affecting a staggering number of websites. Nearly a week after the software's developers issued warnings about the critical flaw, reports indicate that over 550,000 servers could still be at risk. This figure has remained consistent, highlighting the persistent threat to users. As of Monday, around 2,000 instances of cPanel are believed to have been compromised, showing a decrease from approximately 44,000 earlier in the week. This troubling data comes from Shadowserver, a nonprofit organization dedicated to monitoring and addressing cyber threats. The vulnerability allows attackers to seize complete control of affected servers through their management interfaces, leading to significant security breaches. Security experts initially raised alarms on Thursday, noting that hackers had begun infiltrating servers by leveraging this bug. The impact of these attacks has been evident, with Google indexing numerous websites that displayed messages from hackers, claiming to have encrypted files in what appeared to be a ransomware incident. While some of these sites have since returned to normal functionality, the repercussions of such breaches remain serious. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) swiftly reacted to the situation, marking the vulnerability, identified as CVE-2026-41940, in its Known Exploited Vulnerabilities (KEV) catalog. CISA urged government agencies to implement patches by Sunday, although it has not confirmed whether these agencies have successfully secured their systems. Reports suggest that these attacks may have begun even before the vulnerability's public disclosure. KnownHost CEO Daniel Pearson revealed that his team detected suspicious activity as early as February 23. Despite reaching out for comments, executives from Webpros, the company behind cPanel and WHM, have not responded, leaving many questions unanswered amid this ongoing cybersecurity crisis.