Almost per week after the makers of the favored net server administration software program cPanel and WebHost Supervisor (WHM) alerted customers of a important flaw in its software program, hackers are nonetheless concentrating on 1000’s of internet sites that use the weak software program.
As of Monday there are greater than 550,000 probably weak servers operating cPanel, a quantity that has remained secure for days. And there at the moment are round 2,000 cPanel cases doubtless compromised, down from round 44,000 on Thursday. These statistics are revealed by Shadowserver, a nonprofit group that scans and screens the web for cyberattacks.
On Thursday, safety researchers alerted that hackers began compromising servers operating cPanel and WHM, benefiting from a bug that allowed the attackers to take full management of and hijack the weak servers by way of their management panels.
As Bleeping Laptop reported, the extent of the injury is seen by the truth that Google has listed dozens of internet sites that in some unspecified time in the future displayed a message from a bunch of hackers that claimed to have encrypted the sufferer’s information in an obvious ransomware assault. A few of these websites now load usually.
The ransom observe included a chat ID for the victims to contact the hackers, who didn’t instantly reply to TechCrunch’s request for remark.
The U.S. Cybersecurity and Infrastructure Safety Company (CISA) warned on Thursday that the vulnerability — tracked as CVE-2026-41940 — was being exploited within the wild, and added it to its Identified Exploited Vulnerabilities (KEV) catalog. CISA requested authorities companies to patch by Sunday. CISA didn’t instantly reply to a request for remark, asking whether or not it might verify that authorities companies have patched their servers.
The assaults in opposition to net servers operating cPanel and WHM have doubtless been ongoing since a lot sooner than the vulnerability was disclosed. Based on KnownHost CEO Daniel Pearson, his firm detected assaults way back to February 23.
Techcrunch occasion
San Francisco, CA
|
October 13-15, 2026
Executives at Webpros, the corporate that develops cPanel and WHM and says it powers 60 million domains, didn’t reply to a request for remark.
While you buy by hyperlinks in our articles, we might earn a small fee. This doesn’t have an effect on our editorial independence.