Cybersecurity
Critical cPanel and WHM flaw actively exploited in Australia
The ACSC warned that attackers were using a critical cPanel and WHM flaw to get into hosting control panels without a password, and that some managed service providers’ customers had been compromised.
What happened
On 1 May 2026, the ACSC published an alert about active exploitation in Australia of CVE-2026-41940, a critical vulnerability in cPanel and WebHost Manager (WHM).
cPanel is the control panel many Australian web hosts give customers to manage websites, email accounts, databases and files. WHM is the administrator side used by hosting companies and resellers.
The flaw is an authentication bypass: attackers could get into the control panel without valid credentials and run their own code on the server. The ACSC said it affects all versions after 11.40, released in 2013, and that patches were released on 30 April 2026.
Why it matters
Whoever controls cPanel controls the websites and mailboxes on that account. An attacker could change site files, read or redirect email, create new mailboxes for phishing, or steal databases with customer information.
The ACSC noted that products managed by several managed service providers had been affected, leading to the compromise of their customers. That’s an important point for small businesses: you may be exposed through a provider even if you never log in to cPanel yourself.
What to do
If you manage your own hosting server
Update cPanel and WHM to a patched version, use the vendor’s detection scripts to check for compromise, and consider whether the WHM and cPanel login pages need to be reachable from the whole internet.
If you use shared hosting or a provider
Ask your host or IT provider three questions:
- Have you applied the cPanel and WHM patches for CVE-2026-41940?
- Have you checked our account and server for signs of compromise?
- Are you monitoring for suspicious activity?
Either way
- Change your cPanel password and any email account passwords, and turn on two-step verification in cPanel if it’s available.
- Check for email accounts, forwarders, FTP users or files you don’t recognise.
- Make sure you have a recent backup stored somewhere other than the hosting account. See backups that actually work.
A good provider will answer quickly
Clear, specific answers about patching and monitoring are what you should expect. Our guide on choosing a managed IT provider covers the questions worth asking.
Where to get help
If you think your hosting has been compromised, contact your host straight away and call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
Sources
- Active exploitation of cPanel/WHM critical vulnerabilityAustralian Signals Directorate · 01 May 2026Open source