Knowledgebase

Overview

A critical vulnerability CVE-2026-41940 (CVSS 9.8) affected all supported cPanel & WHM versions and was actively exploited in the wild.

Attackers used this flaw to deploy a Linux botnet known as nuclear.x86, leading to full system compromise.

Reference:

Impact

If your server was not patched in time, assume full compromise:

• SSH private keys exposed

• Password hashes leaked (/etc/shadow)

• Shell history accessed (including sensitive commands)

• Full system reconnaissance performed

Indicators of Compromise (IOC)

1. Suspicious Behavior

• wget or curl returns:

Killed

This indicates nuclear.x86 is actively running and blocking commands.

2. Malicious Activity Observed

• Downloaded:

  • hxxp://87.121.84.78/nuclear.x86

  • hxxp://45.148.120.23/nuclear.x86

• Executed:

chmod 777 nuclear.x86
./nuclear.x86 xd

• Removed binary to hide traces

3. Sensitive Files Accessed

Attackers accessed:

• /etc/shadow

• /root/.ssh/*

• Shell history files

• Environment variables

• Network/process information

Immediate Actions (Critical)

Step 1: Update or Disable cPanel Immediately

/scripts/upcp --force

If update is not possible:

whmapi1 configureservice service=cpsrvd enabled=0 monitored=0
whmapi1 configureservice service=cpdavd enabled=0 monitored=0
/scripts/restartsrv_cpsrvd --stop
/scripts/restartsrv_cpdavd --stop

Step 2: Kill Malware Process

pkill -9 -f "./nuclear.x86"
pkill -9 -f "nuclear.x86"
ps auxf | grep -i nuclear

Verify:

wget google.com

• If it works → malware stopped

• If still “Killed” → infection still active

Step 3: Remove Compromised SSH Keys

cp -a ~/.ssh ~/.ssh.compromised.$(date +%Y%m%d)

rm -f ~/.ssh/authorized_keys ~/.ssh/authorized_keys2
rm -f ~/.ssh/id_rsa ~/.ssh/id_rsa.pub
rm -f ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub
rm -f ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa.pub
rm -f ~/.ssh/id_dsa ~/.ssh/id_dsa.pub
rm -f ~/.ssh/known_hosts

Generate New Key:

ssh-keygen -t ed25519 -C "new-key-$(date +%Y%m%d)"

Step 4: Rotate All Credentials

Change immediately:

• cPanel/WHM passwords

• SSH passwords

• FTP/SFTP accounts

• Email accounts

• Database credentials

• API keys and tokens

• CMS admin passwords (WordPress, etc.)

Step 5: Check for Backdoors

Audit:

• Email forwarders

• Cron jobs

• FTP accounts

• SSH authorized keys

• Unknown .php files in public_html

• Recently modified files

Step 6: Re-enable Services (After Cleanup)

/scripts/restartsrv_cpsrvd
/scripts/restartsrv_cpdavd

Verification Checklist

• wget / curl works normally

• No nuclear.x86 process running

• All keys replaced

• Passwords rotated

• No suspicious cron/jobs/files

Important Notes

• Deleting files alone is not enough — process must be killed

• Assume all previously stored secrets are compromised

• If unsure, consider full OS reinstall

Conclusion

This incident highlights the risk of delayed patching.
Immediate updates and strict credential hygiene are critical for server security.