CVE-2026-41940: Active Exploitation of cPanel/WHM Authentication Bypass to Deploy Filemanager Backdoor

Executive Summary

CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel and WebHost Manager (WHM), two of the most widely deployed web hosting management platforms globally. Since its public disclosure in late April 2026, this vulnerability has been under active exploitation by sophisticated threat actors, most notably the actor known as Mr_Rot13. Attackers are leveraging this flaw to deploy the Filemanager backdoor, which enables persistent unauthorized access, credential theft, and the facilitation of further malicious activities such as ransomware deployment, cryptomining, and botnet propagation. The exploitation campaign is global in scope, targeting web hosting providers, shared hosting environments, and enterprises relying on cPanel/WHM. Immediate patching and comprehensive incident response are strongly advised.

Threat Actor Profile

The primary actor exploiting CVE-2026-41940 is identified as Mr_Rot13, a threat actor with a history of low-detection, high-impact campaigns dating back to at least 2020. Mr_Rot13 is characterized by the use of automated mass scanning, custom malware written in Go and PHP, and advanced credential harvesting techniques. The actor’s infrastructure includes long-lived command-and-control (C2) domains and a Telegram group for exfiltration and operational coordination. While not directly attributed to a known Advanced Persistent Threat (APT) group, the sophistication and persistence of Mr_Rot13’s operations suggest a high level of technical capability and operational security.

Technical Analysis of Malware/TTPs

The exploitation chain for CVE-2026-41940 begins with an authentication bypass, allowing remote, unauthenticated attackers to gain administrative access to cPanel/WHM interfaces. The vulnerability is rooted in a CRLF injection flaw within the login flow, enabling attackers to manipulate authentication headers and bypass standard credential checks.

Upon gaining access, attackers execute a shell script via the compromised interface. This script typically uses wget or curl to retrieve a Go-based infector binary from the domain cp.dene[.]de[.]com. The infector implants an SSH public key for persistent access and drops a PHP web shell, often named helper.php, which provides file upload/download capabilities and remote command execution.

Credential harvesting is achieved by injecting malicious JavaScript into the cPanel login page. This script captures user credentials and exfiltrates them to wrned[.]com, with the data ROT13-encoded to evade basic detection. The final stage involves downloading and deploying the Filemanager backdoor from wpsock[.]com. Filemanager is a cross-platform backdoor supporting Windows, macOS, and Linux, offering comprehensive file management, remote shell, and arbitrary command execution.

The infector also collects sensitive artifacts, including bash history, SSH keys, device information, database passwords, and cPanel valiases. All exfiltrated data is transmitted to a Telegram group operated by the user 0xWR, ensuring resilient and covert communication.

The campaign’s technical sophistication is further evidenced by the use of multiple persistence mechanisms (SSH key implantation, web shells, and Telegram-based exfiltration), as well as the deployment of multi-stage payloads and cross-platform malware.

Exploitation in the Wild

Active exploitation of CVE-2026-41940 has been observed at scale, with over 2,000 unique attacker IPs identified globally. The majority of attacks originate from infrastructure in Germany, the United States, Brazil, and the Netherlands, but the campaign is not geographically limited. Victims include web hosting providers, shared hosting environments, and enterprises utilizing cPanel/WHM for web and email management.

Observed outcomes of successful exploitation include ransomware deployment, cryptomining operations, botnet propagation, persistent backdoor access, and widespread credential theft (including administrative, database, and SSH credentials). The attackers’ use of SSH key implantation and Telegram-based exfiltration ensures long-term, stealthy access to compromised environments, even after initial remediation efforts.

The campaign’s scale and automation are facilitated by mass scanning for vulnerable cPanel/WHM instances, rapid exploitation, and the deployment of modular malware capable of adapting to different operating systems and environments.

Victimology and Targeting

The primary targets of this campaign are organizations operating cPanel/WHM servers, particularly those in the web hosting sector. Shared hosting environments are especially vulnerable due to the high concentration of potential victims and the likelihood of lateral movement between hosted accounts. Enterprises relying on cPanel/WHM for internal or customer-facing services are also at significant risk.

Geographically, the campaign has impacted organizations in Germany, the United States, Brazil, and the Netherlands, but evidence suggests a truly global reach. The attackers do not appear to discriminate based on sector or organization size, instead focusing on maximizing the number of compromised hosts for credential theft, monetization (via ransomware and cryptomining), and botnet expansion.

Mitigation and Countermeasures

Immediate action is required to mitigate the risk posed by CVE-2026-41940. Organizations should apply the latest cPanel/WHM security updates as detailed in the official cPanel advisory. All supported versions as of April 2026 are affected, and patching is the most effective defense.

Security teams should conduct thorough hunts for indicators of compromise, including the presence of the domains cp.dene[.]de[.]com, wpsock[.]com, wrned[.]com, and the helper.php web shell. Review all user accounts for unauthorized SSH keys and newly created administrative users. Monitor outbound network traffic for connections to the listed C2 domains and Telegram-based exfiltration endpoints.

If compromise is suspected, immediately isolate affected systems, rotate all credentials (including administrative, database, and SSH keys), and perform a comprehensive forensic review to identify and eradicate all persistence mechanisms. Consider deploying endpoint detection and response (EDR) solutions capable of detecting cross-platform malware and web shell activity.

Ongoing monitoring and threat intelligence integration are essential to detect future exploitation attempts and adapt to evolving attacker tactics.

References

The following resources provide additional technical details and context for CVE-2026-41940 and the associated exploitation campaign:

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our platform leverages advanced threat intelligence, continuous monitoring, and automated workflows to help organizations stay ahead of emerging threats and regulatory requirements. For more information about how Rescana can help secure your organization’s digital ecosystem, please visit https://rescana.com.

We are happy to answer any questions or provide further assistance at ops@rescana.com.