CVE-2026-41940 cPanel & WHM / WP2 Security Update 04/28/2026

[HauntedWebby]

An authentication bypass security issue has been identified in the cPanel software (including DNSOnly) affecting all versions after 11.40.

If you have root access to WHM or cPanel for your site follow the instructions they provide.

• https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

If your on shared hosting and have cPanel, ask your hoster if they following and fixing this issue.

It's an easy fix and validation with 5 terminal bash commands.

 

 

[tngrlkrz]

Thanks for the heads up LeAnne.  I checked and ICDSoft, my host, indicates they don't use that cPanel or WHM software, but rather have their own Control Panel.

Ron

[RickM]

Thanks LeAnne,

I checked in with our Hosting provider.. They are actively monitoring!

Maybe a bit surprised I asked them if they knew too! <Smile>