SECURITY researchers have identified a critical authentication-bypass vulnerability (CVE-2026-41940) in cPanel and WebHost Manager (WHM) affecting millions of websites. Attackers can exploit this flaw to gain administrative access without credentials, posing significant risks, especially as cPanel is widely used by banks and health organizations. Patches were released on April 28, 2026, and users are urged to update their systems.
Hosting providers like Namecheap and HostGator have temporarily restricted cPanel access during this period. Users are advised to limit data sharing, avoid saving payment details online, use unique passwords with a password manager, and consider identity monitoring services.