Executive Summary
A critical global vulnerability (CVE-2026-41940) has been identified in cPanel/WHM and is being actively exploited.
The issue affects over 1.5 million servers globally, potentially impacting hundreds of millions of websites.
As a precaution, all cPanel servers have been temporarily shut down.
No confirmed compromise has been identified within our systems based on current assessments.
Services will be restored only after full security verification and patching is complete.
This is a global industry issue, and our actions are proactive measures to protect all client environments.
Following the disclosure of a critical vulnerability in cPanel & WHM (CVE-2026-41940), we have taken the deliberate decision to temporarily shut down all cPanel-based servers within our infrastructure.
This action is preventive, controlled, and in the best interest of all clients.
Incident Overview
A recently disclosed vulnerability in cPanel/WHM (CVE-2026-41940) has been classified as critical, with confirmed reports of active exploitation in the wild.
The vulnerability enables:
Authentication bypass (unauthorized access without valid login credentials)
Potential privileged-level control of affected servers
Broad impact across multi-tenant hosting environments
Industry-wide assessments indicate that over 1.5 million cPanel servers may be exposed globally. Given that each server can host hundreds to thousands of websites, the potential impact extends to Hundreds of millions of websites worldwide.
This is a systemic software-level vulnerability, affecting hosting providers globally, irrespective of size or internal security standards.
Industry Context
This vulnerability has been widely reported and analyzed by leading cybersecurity firms and global security media, highlighting the severity and urgency of the situation.
Rapid7 : Critical cPanel & WHM Authentication Bypass (CVE-2026-41940)
BleepingComputer : Critical cPanel bug exploited as zero-day before patch release
SecurityWeek : cPanel vulnerability exploited as zero-day for months
Bitsight : Critical vulnerability alert: cPanel WHM authentication bypass
Key findings from these reports include:
CVSS 9.8 (critical severity rating)
Active exploitation in the wild
No authentication required for the attack
Potential full administrative control of servers
Given the widespread adoption of cPanel, this is considered one of the most impactful control panel–level security incidents in recent times.
Risk in Hosting Environments
In cPanel-based hosting architectures, a successful exploit at the control panel layer may allow attackers to:
Access or manipulate website files and databases
Compromise email systems and credentials
Inject malicious code or redirect traffic
Leverage servers for spam or coordinated attacks
Given the nature of hosting, a single compromised server can have cascading effects across multiple client environments.
Our Decision: Full Shutdown of cPanel Servers
After internal risk evaluation, we have elected to:
Fully shut down all cPanel servers as a precautionary measure
This approach ensures:
Reduced exposure window during active exploitation
Reduce containment of potential attack vectors
Maximum protection of client data integrity
While this results in a temporary service interruption, it reflects a security-first operating model aligned with best practices for high-severity incidents.
Responsibility & Transparency
We want to state this clearly:
This issue originates from a 3rd party software vulnerability within cPanel/WHM and is affecting hosting providers globally
It originates from a core vulnerability within the cPanel/WHM software
It is affecting hosting providers globally across all regions
At present:
At this time, our investigations are ongoing, and we are actively reviewing all systems as part of our security assessment
All actions taken are proactive and aligned with industry best practices for risk mitigation under active threat conditions
Remediation & Ongoing Actions
Our engineering and security teams are actively engaged in:
Deploying official vendor patches and verified updates and reload/reboot server as needed.
Conducting comprehensive system integrity audits
Reviewing logs and access patterns for anomalies
Implementing additional hardening controls and access restrictions
Systems will only be brought back online once they meet our internal security clearance standards.
Service Restoration
Service restoration will proceed in a phased and controlled manner once:
All affected systems are fully patched
Security validation checks are completed
Residual risk is reduced to an acceptable level
Our approach prioritizes long-term system integrity over short-term availability
