Critical cPanel Vulnerability CVE-2024-41940: What Website Owners Must Do Right Now

The internet had a very serious week. Here is why it is important to you!

Imagine waking up one morning to find that someone had walked into your shop, rearranged everything, stolen your customer data, and left a ransom note, without ever breaking a lock or picking a door. 

Sounds like a nightmare, right? 

Well, that is almost exactly what happened to thousands of website owners around the world after a critical security flaw was disclosed in one of the most widely used web hosting tools on the planet: cPanel.

If you run a website in Nigeria, be it an eCommerce store, a school portal, a company website, a blog, or a client-facing platform, and that website is hosted on a server running cPanel, then this article is written specifically for you. 

Grab your coffee. We need to talk.

This is not a drill. CVE-2024-41940 scored 9.8 out of 10 on the official vulnerability severity scale. Which is as catastrophically bad as it can get!

First Things First

Let us quickly get everyone on the same page. 

cPanel is the dashboard software that most web hosting companies, including many across Nigeria, use to let customers manage their websites.

It is where you upload files, set up email addresses, manage databases, install WordPress, and handle pretty much everything that keeps your site running.

It is genuinely one of the most popular tools in the web hosting industry globally. 

In fact, Shodan, a search engine for internet-connected devices, found approximately 1.5 million cPanel instances exposed to the internet. 

That is a massive number, and it explains why attackers moved so fast when the flaw was made public.

So What Exactly Went Wrong? Breaking Down CVE-2024-41940

On April 28, 2026, cPanel quietly pushed a security update. The release notes described it as an issue with session loading and saving. 

That is quite the understatement.

Security researchers quickly dug deeper and discovered that this was not a minor bug, it was a critical authentication bypass vulnerability. 

In plain English: attackers could log into your cPanel control panel without knowing your username or password. 

Zero credentials needed. Just full access.

Here is how it worked technically, in the most digestible way possible: 

• cPanel’s service daemon (cpsrvd) writes a session file before authentication even happens. 
• Attackers discovered they could manipulate a specific cookie and inject hidden line-break characters (carriage returns and line feeds, known as CRLF) into an authorization header. 
• The server would accept this, allowing the attacker to inject arbitrary data into the session file. 
• Once that session reloads, the system believed the user was already authenticated, granting full access without ever checking the actual password. 

The vulnerability affects all supported versions of cPanel and WHM after version 11.40, as well as WP Squared, a WordPress hosting management platform built on cPanel.

It was officially assigned the CVE identifier CVE-2024-41940, with a CVSS (Common Vulnerability Scoring System) score of 9.8 out of 10.0. For context, a score of 7.0 already qualifies as “High.” 

A 9.8 means industry experts are essentially saying: patch this immediately, no questions asked.

Statistics at a Glance:

Metric	Value
CVSS Severity Score	9.8 / 10.0 (Critical)
cPanel Instances Exposed on Shodan	~1.5 million exposed online
Potentially Vulnerable Servers Peak	550,000+ (exposed instances)
Compromised IPs at Peak	~44,000 (April 30, 2026)
Active Compromises by May 3	~3,540 (as patches rolled out)
Earliest Known Exploitation	February 23, 2026

The Damage Report: What Actually Happened This Week

Once the proof-of-concept exploit was published by security firm watchTowr on April 29, things moved extremely fast. 

Within 24 hours of public disclosure, multiple threat actors had already weaponised the vulnerability. 

By April 30, the Shadowserver Foundation, a nonprofit that monitors the internet for cyber threats, reported that at least 44,000 unique IP addresses likely compromised via CVE-2024-41940 were actively scanning and launching brute-force attacks against other servers. 

By May 3rd, that number had dropped to around 3,540 as patches were applied, but many servers remained potentially vulnerable.

What were attackers actually doing once they got in? The list is alarming:

• Deploying ransomware: A Go-based Linux ransomware strain nicknamed “Sorry” encrypted files and appended the .sorry extension, then dropped ransom notes instructing victims to pay via Tox messaging.
• Launching botnets: A variant of the infamous Mirai botnet (nuclear.x86) was specifically targeting vulnerable cPanel installations, creating new admin accounts, disabling security logging, and harvesting credentials.
• Website defacement: Attackers replaced website content with their own messages, in some cases announcing that the site had been compromised.
• Credential harvesting: Compromised servers were used to extract login details for other hosted accounts on the same server.
• DDoS infrastructure: Compromised servers were conscripted into armies of machines used to attack other targets on the internet.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) was alarmed enough to add CVE-2024-41940 to its Known Exploited Vulnerabilities (KEV) catalog on April 30, 2026. 

And instructed all U.S. government agencies to patch by May 3, 2026. 

When the Americans are telling their government to drop everything and patch, you know it is serious.

Here is the part that should raise eyebrows: attacks were detected as far back as February 23, 2026, a full two months before the vulnerability was even publicly disclosed. 

This means the flaw was exploited as a zero-day for weeks before anyone publicly knew it existed.

What You Should Do Right Now

Even if you are hosted with a provider that has already patched, there are several steps every website owner should take in the aftermath of a vulnerability this serious.

1) Verify your cPanel version is patched.

Log into your cPanel, scroll to the bottom, and check the version number. Patched versions include:

• 11.110.0.97
• 11.118.0.63
• 11.126.0.54
• 11.132.0.29
• 11.134.0.20
• 11.136.0.5 (or later)
• WP Squared 136.1.7 (or later)

Full details are available from cPanel. If you manage your own server, run /scripts/upcp --force to update.

2) Change your cPanel password immediately.

Even if your account was not compromised, changing passwords after any major security event is best practice. 

Use a strong, unique password, not something you use anywhere else.

3) Enable Two-Factor Authentication (2FA).

Go to your cPanel Security section and enable 2FA using Google Authenticator or a similar app. 

While this specific vulnerability bypassed authentication entirely (including 2FA), enabling 2FA remains a critical best practice to protect against all other types of attacks like password theft or phishing. 

4) Check for unfamiliar files and email forwarders.

Log into your File Manager and look for any files you did not upload, pay close attention to the public_html folder. 

Also check Email > Forwarders to make sure your emails are not being redirected somewhere unknown.

5) Back up your website today.

If you do not have a recent backup, create one right now. A backup is your insurance policy against ransomware, data loss, and everything in between.

6) Contact your hosting support team.

If anything looks suspicious or you are unsure whether your server was patched, reach out to your host directly. 

We at Truehost are available 24/7 to help.

All in All

The internet is not always a safe neighbourhood. 

Vulnerabilities like CVE-2024-41940 are a reminder that the question is never, will something happen? but when it does, is my hosting provider ready?

Security events of this scale separate the professional hosting companies from the careless ones.

We at Truehost are committed to being the kind of host that acts before you even have to ask. 

Be it that you are a solo blogger, a growing eCommerce brand, or an enterprise with multiple domains, your website’s security is our responsibility, and we do not take that lightly.

If you have questions about your hosting security, want to migrate to a safer environment, or simply need a chat with someone who knows their way around a server, our support team is here for you, right now.

Stay safe out there. And keep your cPanel updated. Always.