Over 550,000 servers running cPanel are considered at risk due to a recently disclosed vulnerability, with nearly 2,000 instances reportedly compromised as of Monday. This represents a significant decrease from approximately 44,000 affected servers just a few days prior, according to data from the nonprofit Shadowserver.
The exploitation of the flaw, known as CVE-2026-41940, was first reported by security researchers on Thursday. Hackers have been using this bug to gain complete control over affected servers, leading to a series of compromises that include ransomware attacks. Some victims have publicly displayed ransom notes, and Google has indexed numerous sites that were overtaken by attackers.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included the vulnerability in its Known Exploited Vulnerabilities catalog, urging government agencies to implement patches by Sunday. Despite these warnings, it remains unclear whether all agencies have successfully secured their systems. KnownHost CEO Daniel Pearson indicated that attacks may have been occurring since February 23, prior to the vulnerability being made public.