First reports come in of victims of critical cPanel vuln as 'millions' of sites potentially exposed

CISA has added a critical cPanel bug to its known-exploited list, confirming that attackers are already poking holes in one of the internet's most widely used hosting stacks. The vulnerability, tracked as CVE-2026-41940, carries a near-worst-case CVSS score of 9.8 and affects all supported versions of cPanel and Web[Host …

[Ace2]

Wow, when I checked just now, my low-rent hosting provider had already upgraded to a fixed version. I wasn’t expecting that!

[John Riddoch]

Same with mine - I was expecting to have to chase them up on their lax security, but they'd beat me to it!

[Anonymous Coward]

Phew!

Thank goodness my site and email are fully backed up. Looking forward to a little light entertainment with the ransomware demand.

Reposted as AC so as not to spoil the fun.

[Dr Paul Taylor]

when was the 23rd month of this year?

If people must use this irrational order for giving dates, at least give the name of the month.

[NoneSuch]

Re: when was the 23rd month of this year?

Sir, the 23rd month of the year is, of course, the beginning of Q7.

[Gene Cash]

Re: when was the 23rd month of this year?

Yeah, I'm American and I hate that sh*t too. I use every opportunity to screw with people... "5/2/2026? But February has already passed!"

[razorfishsl]

Re: when was the 23rd month of this year?

Don't get upset , just use a Comma as a decimal point, even though the name is a hint.

[Anonymous Coward]

Re: when was the 23rd month of this year?

I never understood using a comma in place of a decimal point, especially by people who use metric, which is itself decimal...that must have confused them.

[Anonymous Coward]

Re: when was the 23rd month of this year?

> "when was the 23rd month of this year?"

Sounds like a great question for AI to answer, especially when an important report is down to the deadline.

[Anonymous Coward]

Let the flaming commence

Correct me if I'm wrong, but cPanel is a tool that either elevates incompetent people to web administrators or makes website admin easier for people lacking the necessary skills ... take your pick.

Clearly there is a good reason for gaining a better understanding of the underlying systems you are responsible for managing.

[Anonymous Coward]

Re: Let the flaming commence

Yes, it means that you can have some beginning admins do the easy work and leave time for the more senior people to ensure everything stays up to date, but the main benefit is (or, for the moment, was) that customers can self-administer without too much handholding.

Don't be too dismissive of UIs, when well set up they can lower the workload considerably. Or the reverse if they're designed by Mictosoft, but I digress.

[Mishak]

Lucky for me...

I terminated the contract for my hosting a week before as I'm closing the business on the way to retirement (mainly because I really, really can't be bothered with the layers of additional HMRC reporting that are coming in over the next few years)...

Though I'm sure the lot I've been using will have patched by now, as they've always been well ahead of the curve.