A critical vulnerability (CVE-2026-41940) has been discovered in cPanel & WHM and WP Squared (WP2). This flaw allows attackers to bypass authentication and gain full server access — putting your websites, client data, and business at serious risk.

For anyone running shared hosting, reseller hosting, VPS, or dedicated servers in India, this update is mandatory.

🔍 What is CVE-2026-41940?

CVE-2026-41940 is an authentication bypass vulnerability affecting cPanel & WHM login systems.

👉 In simple terms:
Hackers can log in without username or password.

This makes it extremely dangerous for:

Web hosting providers in India
Reseller hosting businesses
Developers managing multiple client websites

⚠️ Why This is Critical

No authentication required
Remote exploitation possible
Full root/admin access achievable
CVSS Score: 9.8 (Critical)

Once exploited, attackers can:

Take control of the entire server
Access all hosted websites and databases
Inject malware or backdoors
Steal sensitive data
Delete or corrupt server data

What is Actually Happening?

The technical root of the issue lies in a function called saveSession. Normally, when you log into cPanel, the system sanitizes the data. However, researchers found that attackers can bypass this sanitization by injecting CRLF (Carriage Return Line Feed) characters into requests .

In simple terms, they can “trick” the server into writing malicious commands into a session file. The most dangerous aspect is that they can inject a hasroot=1 value, which tells the server they are the root administrator—without ever providing a password

Who is Affected & The Scope of Damage

✅ Fixed Versions

cPanel & WHM: Versions below 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, and 11.136.0.5.
WP Squared (WP2): Versions below 136.1.7.

The Damage (What happens if you get hacked):
Because this is an authentication bypass leading to root access, the impact is catastrophic. A successful attacker can :

Take full control of your WHM (WebHost Manager).
Access every single website, database, and email account on your server.
Steal SSL certificates and modify DNS records.
Use your server as a launchpad to attack your customers (lateral movement).

Step-by-Step Remediation Checklist

Do not just read this. Run these commands or forward them to your systems administrator immediately.

1. Patch Immediately

You must update your software to the patched versions listed above.

Standard Update: Log into WHM as root and go to Home > cPanel > Upgrade to Latest Version.
Command Line (SSH): Run the update script manually:
```
/scripts/upcp --force
```

2. Verify the Update

After updating, confirm you are on a safe version.

/usr/local/cpanel/cpanel -V

3. Run the Official Detection Script

cPanel has released an official IoC (Indicators of Compromise) script called ioc_checksessions_files.sh .

Important: There was an early issue with false positives, but cPanel released an updated script on May 1st. Ensure you download the latest version from the official cPanel support page .
Run the script to see if your server has already been hit

/bin/bash ioc_checksessions_files.sh
If it returns “CRITICAL findings”: Assume your server is compromised. You need to investigate users, reset all passwords (root and reseller), and check for backdoors .

4. Restart Services

To ensure the session handler is fully reset:

/scripts/restartsrv_cpsrvd --hard

🛡️ Temporary Protection (If You Cannot Update Immediately)

Block ports:
- 2083 (cPanel)
- 2087 (WHM)
- 2096 (Webmail)
Restrict access via firewall (CSF recommended)
Allow only trusted IPs (India office / admin IP)

⚠️ This is not a permanent fix.

🔎 How to Check if Your Server is Compromised

Look for:

Unknown admin logins in WHM
Suspicious processes running as root
Modified system files
Unexpected cron jobs

👉 If you notice anything unusual, perform a full security audit immediately.

💡 Best Security Practices for Hosting Providers in India

To protect your hosting business and clients:

Enable automatic cPanel updates
Use CSF firewall + Imunify360
Enable 2FA for WHM/cPanel
Disable unused services
Regular malware scanning
Daily backups (offsite recommended)