Attackers are breaking into Linux web hosting servers en masse by abusing a critical flaw in cPanel and WHM, the control panels that millions of websites rely on to manage hosting. Security firm XLab says one persistent group, which it nicknamed Mr_Rot13, is using the bug to quietly install a long-running backdoor, while a much larger crowd of opportunists piles on with cryptocurrency miners, ransomware, and bots. The flaw, tracked as CVE-2026-41940, is an authentication bypass: it lets a remote attacker skip the login screen entirely and gain administrator control with no credentials at all.
What's affected
The vulnerability sits in the cPanel and WHM control panel software used to run shared web hosting. It was publicly disclosed on April 28, 2026 and carries a maximum-severity CVSS score of 9.8, the kind of rating reserved for bugs that are both easy to exploit and devastating once they are. Because the panel manages every site on a server, a single break-in can expose every customer hosted there. XLab researcher Alex Turing reports that more than 2,000 attacker IP addresses are currently hammering the flaw with automated attacks, mostly from Germany, the United States, Brazil, and the Netherlands. On May 2, 2026, the security community disclosed a separate case in which attackers used the same flaw to breach Southeast Asian government and military bodies and steal roughly 4.37 GB of files dating back to 2020 to 2024.
How the attack works
On May 4, XLab caught a distinctive Go-based infector (which the malware itself calls "Payload") being dropped through the bug. Tell-tale Turkish log messages, chatty AI-style code comments, and a callback address scrambled with ROT13, a simple letter-shifting cipher (uggcf://jearq.pbz/ybt.cuc decodes to hxxps://wrned[.]com/log[.]php), gave the group its Mr_Rot13 nickname. Once inside, the infector resets the server's root password, plants an SSH key labelled cpanel-updater so the attackers can log back in, installs a Python webshell at /usr/local/cpanel/cgi-sys/cpanel.py, and slips a credential-stealing login.js into the cPanel login page to harvest passwords from real users. It finishes by deploying a cross-platform remote access tool called filemanager that runs on Linux, macOS, and Windows.
Telegram command channel
Stolen data, including credentials, command history, SSH keys, database passwords, and Valiases mail config, is sent to hxxps://cp[.]dene[.]de[.]com/collect[.]php and mirrored into a 3-member Telegram group (ID -443071772) run by a user going by 0xWR. After a researcher pinged the group's bot on May 4, the operators swapped the bot token and pulled it from the group within hours, a sign of an alert, hands-on adversary. XLab assesses with moderate confidence that the same crew is tied to a PHP backdoor (helper.php) uploaded to VirusTotal in 2022 with zero detections, which beacons to the same wrned[.]com server, pushing the group's activity back to at least 2020. XLab published its full analysis in its Cyber Threat Insight and Analysis System report.
What you should do
Anyone running internet-facing cPanel or WHM should apply the vendor patch immediately, since exploitation is expected to keep surging while unpatched servers stay exposed. Beyond patching, check for signs of compromise: audit /usr/local/cpanel/cgi-sys and the login templates for unauthorized changes, rotate root credentials, and review SSH authorized_keys for the cpanel-updater entry. Useful indicators (defanged) include the C2 domains wrned[.]com, cp[.]dene[.]de[.]com, and wpsock[.]com, scanner IPs 178[.]249[.]209[.]182 and 149[.]102[.]229[.]146, and file hashes fb1bc3f935fdeb3555465070ba2db33c (Payload), 9305b4ebbb4d39907cf36b62989a6af3 (filemanager Linux amd64), and 2286f126ab4740ccf2595ad1fa0c615c (helper.php).
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.