TLDR Tech / InfoSec
The cPanel Zero-Day Was Active for 64 Days Before Anyone Knew
KnownHost CEO Daniel Pearson confirmed exploitation attempts against CVE-2026-41940 (CVSS 9.8) starting February 23, roughly 64 days before cPanel's April 28 advisory, indicating attackers found the CRLF injection authentication bypass in cPanel/WHM session handling well before the researcher who responsibly disclosed it. Censys identified over 1 million exposed cPanel/WHM hosts (Rapid7 put the figure near 1.5 million across versions 11.86.0 through 11.136.0 and WP Squared v136.1.7 and earlier), and on May 1 alone, 15,448 cPanel hosts (79.99% of GreyNoise's malicious-host tracking that day) participated in attack activity, with 7,135 hosts already showing Sorry Ransomware ".sorry" extensions on WordPress core files and a separate Mirai variant ("nuclear.x86") deployed via Telnet post-compromise. CISA added the CVE to the KEV catalog on April 30, with a May 3 federal deadline. NocInit recommends migrating any server that was internet-accessible on ports 2082-2096 during the February-April window to a clean install from pre-breach backups rather than cleanup.
Read the full story