cPanel Security Vulnerabilities Exploited
On 30 April, BleepingComputer reported that attackers were exploiting a critical cPanel and WHM vulnerability as a zero-day. Proof-of-concept code later became available. BleepingComputer also described an emergency update for a critical authentication bypass, then reported mass exploitation in “Sorry” ransomware attacks. Malwarebytes Labs said the actively exploited flaw exposed millions of websites to takeover.
The Hacker News reported a critical cPanel authentication vulnerability that required an immediate server update, followed by fixes for three new vulnerabilities. It also said attackers were exploiting CVE-2026-41940 to deploy a Filemanager backdoor and the LiteSpeed cPanel Plugin vulnerability CVE-2026-48172 to run scripts as root.
By 16 September, reports covered targeted attacks exploiting a vulnerability in the Acronis cPanel Backup Plugin, according to The Hacker News. Dev.to identified CVE-2026-87886 as insecure file permissions in Acronis Backup Plugins for cPanel, WHM and Plesk. The sequence spans the hosting control panel, authentication, backup tooling and third-party plugins. Patching the control panel is insufficient when extensions remain vulnerable.
Taking the reports as factual, impact is 10%. Administrators running cPanel, WHM or Plesk, particularly those using the affected Acronis and LiteSpeed plugins, face authentication bypass, website takeover, backdoor deployment, ransomware and root-level script execution. They should immediately patch and review exposed servers and plugins.
Watch for vendor advisories, further patch releases, compromise indicators and clearer figures on the number of affected servers or websites. Evidence that ties the reported campaigns together or separates them into distinct incidents would materially change the picture.
<h1> CVE-2026-87886: Insecure File Permissions in Acronis Backup Plugins for cPanel, WHM and Plesk </h1> <h2> Vulnerability overview </h2> <p>CVE-2026-87886 is a privilege
cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel
cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and
A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised
A critical vulnerability affecting all but the latest versions of cPanel and the WebHost Manager (WHM) dashboard could be exploited to obtain access to the control panel without
A vulnerability in the cPanel/WHM admin interface lets attackers access websites without a username and password.
A new disclosed cPanel flaw tracked as CVE-2026-41940 is being mass-exploited to breach websites and encrypt data in "Sorry" ransomware attacks. [...]
A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →