Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks
Unknown threat actor exploits critical cPanel vulnerability to target Southeast Asian governments and MSPs.
A previously unknown threat actor has been actively exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel/WHM, to target government and military entities in Southeast Asia (Philippines, Laos) as well as MSPs and hosting providers across multiple countries. The attacker used the AdaptixC2 C2 framework along with OpenVPN and Ligolo for persistence, and exfiltrated Chinese railway-sector documents. Multiple third-party threat actors, including operators of Mirai botnet variants and the Sorry ransomware strain, have also weaponized the vulnerability within 24 hours of public disclosure, with an estimated 44,000 compromised IP addresses detected.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ctrl-Alt-Intel?
Get an email when a new story names Ctrl-Alt-Intel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 95.111.250.175
- cve — CVE-2026-41940
- malware — AdaptixC2
- malware — Mirai
- malware — Sorry