Knowledgebase

On April 28, 2026, cPanel disclosed CVE-2026-41940, a critical authentication bypass vulnerability (CVSS 9.8). This flaw allows unauthenticated remote attackers to gain root-level access to affected servers.

If your server was exposed before patching, assume compromise unless proven otherwise.

Important Warning

If an attacker gained access:

• Applying patches does NOT remove them

• Persistence mechanisms (SSH keys, cron jobs, rootkits) often survive cleanup

• Even professional cleanup can miss hidden backdoors

Best practice: Rebuild the server on a clean installation as soon as possible

Initial Detection

Signs of compromise include:

• Unknown sessions in /var/cpanel/sessions/raw/

• Suspicious WHM logins

• Unexpected website modifications

You may run cPanel’s detection script, but note:

Detection tools cannot guarantee the server is clean

Step-by-Step Mitigation

1. Reset Root Password

If you still have SSH access:

passwd

If locked out:

• Boot into rescue/recovery mode

• Mount filesystem and reset password

• Reboot normally

2. Audit Root SSH Keys

cat /root/.ssh/authorized_keys

• Remove anything unfamiliar

• Attackers commonly add SSH keys to maintain access

3. Check Cron Jobs (Persistence Hotspot)

Check root cron:

crontab -l

Inspect all cron locations:

ls -la /etc/cron.d/
/etc/cron.hourly/
/etc/cron.daily/
/etc/cron.weekly/
/etc/cron.monthly/

Also review:

/etc/crontab
/var/spool/cron/
/etc/anacrontab

Look for:

• Recently modified files (especially after April 28, 2026)

• Suspicious commands:

  • curl | bash

  • wget | sh

  • base64 payloads

  • unknown domains/IPs

  • reverse shells disguised as scripts

4. Check Running Processes

ps auxf --sort=-%cpu | head -40
ps auxf --sort=-%mem | head -30
ps -ef --forest

• Investigate unknown or resource-heavy processes

5. Revoke WHM API Tokens

In WHM:

• Navigate to Manage API Tokens

• Revoke:

  • Unknown tokens

  • Unused tokens

Tokens persist even after password resets

6. Restrict SSH Access

Edit:

/etc/ssh/sshd_config

Add:

AllowUsers root

Or replace root with your admin user.

Restart SSH:

service ssh restart

Test access before closing your session.

7. Audit Sudo Privileges

Check groups:

getent group sudo
getent group wheel

Review:

cat /etc/sudoers

Look for entries like:

username ALL=(ALL) NOPASSWD: ALL

• Remove any unauthorized users

Also check:

/etc/sudoers.d/

8. Install Firewall & Block Access Ports

Install CSF:

yum -y install cpanel-csf

Edit config:

/etc/csf/csf.conf

Remove from TCP_IN:

2082, 2083  (cPanel)
2086, 2087  (WHM)
2095, 2096  (Webmail)
22          (SSH)

Set:

TESTING = "0"

Whitelist your IP:

csf -a YOUR-IP

Restart firewall:

csf -e
csf -r

Final Recommendation

If you find any sign of exploitation:

✔ Do NOT trust the system
✔ Do NOT rely on cleanup

Instead:

1. Provision a new clean server

2. Install fresh cPanel

3. Restore backups from before compromise

4. Decommission the old server