ASD's ACSC said in a 1 May 2026 critical alert that it is 'aware of active exploitation in Australia of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products', according to Cyber Daily (4 May). The CVE record (NVD) describes it as an authentication bypass in cPanel and WHM versions after 11.40 that allows unauthenticated remote attackers to gain unauthorized access to the control panel. cPanel says it released security updates for cPanel & WHM on 28 April 2026.

Correction (23 Oct 2026): this card earlier also mentioned CVE-2026-4194, which is an unrelated D-Link NAS flaw; the cPanel/WHM issue is CVE-2026-41940.

Correction (23 Oct 2026): removed a line saying the ACSC noted patches as of 30 April 2026, which rested only on an ASD page we cannot recheck; the ACSC alert is now credited to Cyber Daily.