Security researchers are sounding the alarm on a newly discovered vulnerability in the widely used web server management software cPanel and WebHost Manager (WHM).
The bug allows hackers to hijack and take full control of the servers running the affected software, which is thought to be used by tens of millions of website owners around the world.
Many commercial web hosting companies have patched their customers’ systems already. But the cPanel maker urged customers to ensure that their systems are patched as the bug affects all supported versions of the software.
cPanel and WHM are two software suites used for managing web servers that host websites, manage emails, and handle important configurations and databases needed to maintain an internet domain. The two suites have deep-access to the servers that they manage, allowing a malicious hacker potentially unrestricted access to data managed by the affected software.
The bug, officially tracked as CVE-2026-41940, allows malicious hackers to remotely bypass its login screen to gain full access to the software’s administration panel.
Given the ubiquity of the cPanel and WHM software across the web hosting industry, hackers could compromise potentially large numbers of websites that haven’t patched the bug.
Canada’s national cybersecurity agency said in an advisory that the bug could be exploited to compromise websites on shared hosting servers, such as large web hosting companies.
The agency said that “exploitation is highly probable” and that immediate action from cPanel customers, or their web hosts, is necessary to prevent malicious access.
Web hosting giant Namecheap, which uses cPanel to allow its customers to manage their web servers, said the company blocked access to customers’ cPanel panels after learning of the flaw to prevent exploitation, and to give it time to patch its customers’ systems.
Hostgator also said it patched its systems and is considering the bug a “critical authentication-bypass exploit.”
One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.
KnownHost CEO Daniel Pearson said in a post on Reddit that his company has seen attempts to exploit the vulnerability as far back as February 23. The company said it also briefly began blocking access to customer systems before applying patches.
According to Pearson, around 30 servers at KnownHost showed signs of unauthorized attempted access out of thousands of computers on its network. Pearson likened the efforts to attempts, and has not seen signs of active compromise. cPanel also said it rolled out a security fix for WP Squared, a similar tool for managing WordPress websites.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
The Nigeria Democratic Congress, NDC, Director of New Media and Strategic Communications, Theo Abu Agada on Monday insisted that the Anambra State Government is threatened by the growing popularity of the party’s presidential candidate, Peter Obi.
Agada said the NDC would win big in Anambra State and that there is nothing Governor Chukwuma Soludo and his All Progressives Grand Alliance (APGA) can do about it.
He was reacting to a post on X by @AnambraNewMedia, which said a vote for Obi would be a betrayal of the state.
The post reads: “A betrayal alert for Ndi Anambra. Do not be deceived by a man who abandoned his own house.
Recommended
“Ndi APGA, defend your home. Resist the NDC. A vote for Peter Obi and NDC is a vote to kill APGA. Since 2014, Obi has had one mission: to destroy the party that made him.”
Reacting, Agada accused the state government of resorting to cheap blackmail because it could not challenge Obi on his governance record.
He wrote: “It is now clear, even to the blind, that the Anambra State Government is threatened by the growing popularity of our presidential candidate, H.E. Peter Obi, and the NDC in Anambra State and beyond.
“I understand this mad obsession. The NDC is going to win big in Anambra, and there is nothing Soludo and his minions in APGA can do about it.
“Since they cannot challenge H.E. Peter Obi on his governance record, they have resorted to cheap blackmail.”
Jide-Ojo Jide Olusola, SA Media to the Senior Special Assistant to the President on Grassroots Sports Development, Hon. Adeboye Anthony Adeyinka, has been named among the speakers for the Year of Return Africa (YORA) Summit & Expo 2026 holding in Nairobi, Kenya.
Jide-Ojo, Founder/CEO of 247SportsNetwork Limited, publishers of Sports247.ng, will join leading African business executives, investors, innovators and industry stakeholders at the summit scheduled for October 13–14 at Broadwalk Mall, Westlands, Nairobi.
The veteran media executive, who has accumulated over 30 years of experience in the media industry, will participate in the summit’s sport business segment on October 14, bringing perspectives from sports journalism, grassroots development, strategic communications, partnerships and the commercialisation of African sport.
Jide-Ojo joins a diverse speakers’ lineup that includes Blue Mahoe Capital Chairman and CEO David Mullings, Kenya Film Commission Board Chairman Sudi Wandabusi, Capital Markets Authority Blockchain and Fintech Analyst James Hillary Obonyo, Emmppek Group Chairman Emmanuel Audu-Ohwavborua, and B|E Strategy Founder and Chief Strategist Charles Ellison, among others.
The summit, themed “Fueling the Future: Unlocking Africa’s Entrepreneurial Potential,” will examine investment, innovation, technology, entrepreneurship and opportunities within Africa’s creative economy.
A major focus of the sport business conversation will be the monetisation of Africa’s sports, media and entertainment industry, including how the continent can transform its enormous sporting talent, passionate audiences and compelling stories into sustainable commercial opportunities.
Through Sports247 and his current media role supporting the Presidency’s grassroots sports development agenda, Jide-Ojo has consistently promoted emerging athletes, grassroots competitions and initiatives aimed at creating greater visibility and opportunities within Nigeria’s sports ecosystem.
His contribution in Nairobi is expected to highlight the increasingly important role of media, digital storytelling, athlete branding, sponsorship and strategic partnerships in building commercially sustainable African sports properties.
The Nairobi platform will also provide an opportunity to share Nigeria’s grassroots sports experience while strengthening connections between sport, media, investment and business across Africa.
Following the Nairobi programme, YORA activities will continue in Kilifi, Kenya, from October 16–17.
YORA Summit & EXPO Kenya, 2026 is a three-day event including YORA Awards taking place from 12th – 17th Nairobi | Kilifi, Kenya