Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks

A critical cPanel vulnerability (CVE-2026-41940) is weaponized against government and military entities in Southeast Asia, plus MSPs across multiple countries.

• •CVE-2026-41940 enables authentication bypass and remote control panel access in cPanel and WebHost Manager systems
• •Attack targets include Philippine and Laotian government/military domains, plus MSPs in Canada, South Africa, and the U.S.
• •Attackers used authenticated SQL injection and remote code execution against Indonesian defense sector portals with hardcoded credentials
• •AdapdixC2 C2 framework with OpenVPN and Ligolo establish persistent access for network pivoting and data exfiltration
• •Over 44,000 IP addresses compromised within 24 hours of disclosure, with ransomware and botnet variants deployed