Hackers are still exploiting the cPanel bug to take control of thousands of websites

Nearly a week after the makers of popular web server management software cPanel and WebHost Manager (WHM) alerted users of a critical flaw in their software, hackers are still targeting thousands of websites using the vulnerable software.

As of Monday there More than 550,000 The most likely vulnerable servers were running cPanel, a number that has remained stable for several days. And there it is now Around 2000 cPanel instances were likely compromised, down from about 44,000 on Thursday. These statistics are published by Shadowserver, a non-profit organization that scans and monitors the Internet for cyberattacks.

Security researchers alerted to this on Thursday Hackers began hacking servers using cPanel and WHMtaking advantage of a bug that allowed attackers to take full control of vulnerable servers and hijack them via their control panels.

As reported by Bleeping ComputerThe extent of the damage is clear from the fact that Google It has been indexed Dozens of websites that at one point displayed a message from a group of hackers who claimed to have encrypted the victim’s files in an apparent ransomware attack. Some of these sites are now loading normally.

The ransom note included a chat ID for victims to contact the hackers, who did not immediately respond to TechCrunch’s request for comment.

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Thursday that the vulnerability – named CVE-2026-41940 – was exploited randomly, and She added it To the catalog of known exploited vulnerabilities (KEV). CISA asked government agencies to correct by Sunday. CISA did not immediately respond to a request for comment, asking whether it could confirm that government agencies had patched its servers.

Attacks against web servers running cPanel and WHM have likely been ongoing long before the vulnerability was disclosed. According to KnownHost CEO Daniel Pearsonhis company detected attacks dating back to February 23.

Executives at Webpros, the company that develops cPanel and WHM and says it operates 60 million domains, did not respond to a request for comment.