Talk to an expert
ProductsSolutionsTrustPricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Critical cPanel Auth Bypass (CVE-2026-41940) Fuels New Mirai Botnet Wave

A severe authentication-bypass flaw in cPanel and WHM is being used to turn hosting servers into Mirai botnet nodes, with a sharp worldwide spike in Telnet-style scanning traffic.

4T4Tify Team4Tify
Sep 21, 2026·4 min read
Critical cPanel Auth Bypass (CVE-2026-41940) Fuels New Mirai Botnet Wave

Critical cPanel Auth Bypass Fuels New Mirai Botnet Activity

Attackers are exploiting a critical authentication-bypass vulnerability in cPanel and WHM — tracked as CVE-2026-41940 — to plant Mirai-derived malware on exposed hosting servers, pulling web infrastructure into a botnet ecosystem usually associated with IoT devices.

What happened

Security researchers observed a sharp spike in Mirai-style scanning traffic aimed at TCP port 23 — the Telnet port — beginning around April 30 and peaking in early May before gradually tapering off. Investigators traced a large share of the source addresses back to hosting-provider ranges, and many of the flagged hosts turned out to be running cPanel administration panels rather than IoT devices.

The bypass itself is what makes this notable: CVE-2026-41940 lets an attacker reach administrative functionality in cPanel/WHM without valid credentials, giving them a foothold on the server itself rather than just the one site it hosts. From there, Mirai-derived code can probe other exposed services, spread laterally, or be repurposed to generate DDoS traffic — extending the blast radius well past the original control panel.

Traffic analysis suggests the pattern was global rather than concentrated: the United States carried the largest share of source traffic, with sharp increases also recorded in Germany, France, and Canada around May 1. Japan saw Telnet-targeting traffic climb to roughly 15 times its pre-surge baseline. Investigators note that traffic monitoring alone can't prove the exact infection chain, but the timing and pattern point strongly to Mirai or a Mirai variant riding the cPanel flaw.

Why it matters

This is a reminder that Mirai-family malware isn't limited to routers and cameras — any internet-facing service with a serious auth bypass and reachable legacy ports is fair game. Hosting panels are especially high-value: a single compromised cPanel/WHM instance can affect every site and customer it manages, not just the account that was breached.

What to do

  • Patch immediately. Apply the vendor fix for CVE-2026-41940 across every cPanel/WHM instance and confirm no unpatched copies remain internet-reachable.
  • Close unnecessary exposure. Disable Telnet unless it's explicitly required, and restrict administrative interfaces to trusted networks or a VPN.
  • Rotate weak credentials. Mirai variants thrive on default and reused passwords — enforce strong, unique credentials on every management interface.
  • Hunt for compromise. Review cPanel and system logs for unexpected admin sessions, new accounts, configuration changes, or unfamiliar files, and check for unusual outbound connections or processes.

Source: Cyber Security News

SHARE