A critical authentication bypass in cPanel, WHM, and WP Squared — tracked as CVE-2026-41940 — has been actively exploited in the wild since at least late February, and it took until this week for a public disclosure, a PoC release, and a CISA Known Exploited Vulnerabilities listing to arrive more or less simultaneously. That timeline — roughly two months of quiet exploitation before the world was told — is the part worth sitting with.

The flaw lets an attacker bypass authentication entirely and gain administrative access to a vulnerable server. No credentials required. cPanel is the control panel software that underpins a significant share of shared web hosting globally; conservative estimates put the number of affected sites in the tens of millions. The PoC is now public, which means the window between "patch available" and "commodity exploit in the wild" is essentially closed.

What happened, technically: The bug lives in cPanel's authentication layer. An unauthenticated request, crafted correctly, can leapfrog the login check and arrive at privileged functionality. Hosting providers have confirmed they observed exploitation attempts dating back to February, which means threat actors had a working exploit well before security researchers published their findings. That's a classic zero-day gap — and in this case, a long one.

Why it matters beyond the obvious: cPanel is everywhere. It sits under budget hosting accounts, SMB websites, and the managed WordPress stacks of businesses that have never thought about their control panel software. The organisations most exposed are the ones least likely to have a patching cadence at all. CISA's KEV listing means US federal agencies have a hard deadline to remediate, but the long tail of vulnerable instances across commercial hosting will take much longer to clear.

The supply chain angle is real too. Attackers with admin access to a cPanel instance can modify DNS records, inject malicious code into hosted sites, intercept email, and pivot to hosted databases — all from a single authentication bypass. One compromised shared hosting server can affect hundreds of downstream sites.

Australian context: Australian small businesses and government-adjacent organisations that rely on shared hosting are in the blast radius here. The ACSC has not yet published a specific advisory, but the CISA KEV listing and the active exploitation status mean this should be treated as urgent. Hosting providers operating under the Privacy Act's notifiable data breach scheme should be assessing exposure now — a compromised cPanel instance with access to customer data would almost certainly trigger notification obligations.

Patch immediately. If you run cPanel or WHM, check your version against the vendor's patched releases. If you're on managed hosting and don't know whether your provider has patched, ask. The PoC being public means this is no longer a question of "if" attackers will try — they already have been.