{"id":4363,"date":"2026-05-09T16:31:21","date_gmt":"2026-05-09T16:31:21","guid":{"rendered":"https:\/\/www.copahost.com\/blog\/?p=4363"},"modified":"2026-05-09T16:31:25","modified_gmt":"2026-05-09T16:31:25","slug":"cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers","status":"publish","type":"post","link":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/","title":{"rendered":"cPanel&#8217;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers"},"content":{"rendered":"\n<p>If you run a server with cPanel or WHM, you need to read this carefully.<\/p>\n\n\n\n<p>On May 8, 2026 \u2014 just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware \u2014 cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203.<\/p>\n\n\n\n<p>Two of the three carry a CVSS score of 8.8. That puts them firmly in the <strong>High severity<\/strong> tier, one step below Critical.<\/p>\n\n\n\n<p>This is the second Technical Security Release (TSR) in 10 days from <a href=\"https:\/\/www.copahost.com\/blog\/cpanel\/\">cPanel<\/a>. Two emergency patches in less than two weeks is not normal, and the timing \u2014 immediately following the worst cPanel attack in years \u2014 tells a clear story: the ransomware incident triggered a deeper code audit, and that audit found more problems.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_69_1 ez-toc-wrap-center counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#What_Is_a_cPanel_TSR\" title=\"What Is a cPanel TSR?\">What Is a cPanel TSR?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#The_Three_New_Vulnerabilities\" title=\"The Three New Vulnerabilities\">The Three New Vulnerabilities<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#CVE-2026-29201_%E2%80%94_Arbitrary_File_Read_CVSS_43\" title=\"CVE-2026-29201 \u2014 Arbitrary File Read (CVSS 4.3)\">CVE-2026-29201 \u2014 Arbitrary File Read (CVSS 4.3)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#CVE-2026-29202_%E2%80%94_Arbitrary_Perl_Code_Execution_CVSS_88\" title=\"CVE-2026-29202 \u2014 Arbitrary Perl Code Execution (CVSS 8.8)\">CVE-2026-29202 \u2014 Arbitrary Perl Code Execution (CVSS 8.8)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#CVE-2026-29203_%E2%80%94_Privilege_Escalation_via_Unsafe_Symlink_CVSS_88\" title=\"CVE-2026-29203 \u2014 Privilege Escalation via Unsafe Symlink (CVSS 8.8)\">CVE-2026-29203 \u2014 Privilege Escalation via Unsafe Symlink (CVSS 8.8)<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#Context_What_Just_Happened_to_cPanel\" title=\"Context: What Just Happened to cPanel\">Context: What Just Happened to cPanel<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#How_to_Patch_%E2%80%94_Step_by_Step\" title=\"How to Patch \u2014 Step by Step\">How to Patch \u2014 Step by Step<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#Should_You_Also_Check_for_the_Previous_Compromise\" title=\"Should You Also Check for the Previous Compromise?\">Should You Also Check for the Previous Compromise?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#The_Broader_Pattern\" title=\"The Broader Pattern\">The Broader Pattern<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#Summary_Checklist\" title=\"Summary Checklist\">Summary Checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#Sources\" title=\"Sources\">Sources<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Is_a_cPanel_TSR\"><\/span>What Is a cPanel TSR?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Before diving into the vulnerabilities, a quick note for context: cPanel uses a standardized process called a Technical Security Release (TSR) when a security patch is ready. cPanel notifies registered customers in advance so they can prepare update windows and maintenance schedules. CVE numbers are reserved through MITRE, but full technical details are embargoed until the moment the patch goes live \u2014 to prevent exploitation before a fix is available.<\/p>\n\n\n\n<p>On May 7, 2026, WebPros sent a second TSR pre-disclosure email to registered customers \u2014 the second such emergency notice in ten days. The patches were released on May 8 at 12:00 EST.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Three_New_Vulnerabilities\"><\/span>The Three New Vulnerabilities<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CVE-2026-29201_%E2%80%94_Arbitrary_File_Read_CVSS_43\"><\/span>CVE-2026-29201 \u2014 Arbitrary File Read (CVSS 4.3)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>What it is:<\/strong> An insufficient input validation of the feature file name in the <code>feature::LOADFEATUREFILE<\/code> adminbin call that could result in an arbitrary file read.<\/p>\n\n\n\n<p><strong>What it means in practice:<\/strong> An authenticated attacker can manipulate the feature file name parameter to read files on the hosting server they should not have access to. While this does not directly grant root access, the information gathered \u2014 configuration files, credentials, internal paths \u2014 can be used to stage more damaging follow-up attacks.<\/p>\n\n\n\n<p><strong>Severity:<\/strong> Moderate (CVSS 4.3). Lower urgency than the others, but still worth patching immediately given the current threat environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CVE-2026-29202_%E2%80%94_Arbitrary_Perl_Code_Execution_CVSS_88\"><\/span>CVE-2026-29202 \u2014 Arbitrary Perl Code Execution (CVSS 8.8)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>What it is:<\/strong> An insufficient input validation of the <code>plugin<\/code> parameter in the <code>create_user<\/code> API call that could result in arbitrary Perl code execution on behalf of the already authenticated account&#8217;s system user.<\/p>\n\n\n\n<p><strong>What it means in practice:<\/strong> This is the most dangerous of the three. An authenticated user \u2014 which could be any account holder on a shared server \u2014 can inject arbitrary Perl code through the <code>create_user<\/code> API. Perl code running in the context of cPanel has significant system-level access. On a shared hosting server, this could allow one tenant to run code that affects the entire machine.<\/p>\n\n\n\n<p><strong>Severity:<\/strong> High (CVSS 8.8). Requires authentication, but on shared hosting, that bar is low \u2014 any account is enough.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"CVE-2026-29203_%E2%80%94_Privilege_Escalation_via_Unsafe_Symlink_CVSS_88\"><\/span>CVE-2026-29203 \u2014 Privilege Escalation via Unsafe Symlink (CVSS 8.8)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>What it is:<\/strong> An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation.<\/p>\n\n\n\n<p><strong>What it means in practice:<\/strong> By creating a symlink that points to a sensitive system file and triggering a chmod operation through cPanel, an attacker can change permissions on files they should not be able to touch. This can lead to privilege escalation or denial of service if system files are rendered inaccessible.<\/p>\n\n\n\n<p><strong>Severity:<\/strong> High (CVSS 8.8). In combination with CVE-2026-29202, these two flaws could be chained: execute code to create the symlink, then use the chmod escalation to gain deeper access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Context_What_Just_Happened_to_cPanel\"><\/span>Context: What Just Happened to cPanel<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>To understand why these three patches matter more than their individual CVSS scores suggest, it is necessary to look at what happened in the ten days before them.<\/p>\n\n\n\n<p>On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940 \u2014 a CVSS 9.8 authentication bypass that allowed unauthenticated remote attackers to gain administrative access to cPanel and WHM. The flaw was actively exploited as a zero-day with exploitation attempts dating back to late February 2026 \u2014 meaning attackers had a roughly two-month head start before a fix was available.<\/p>\n\n\n\n<p>The consequences were immediate and severe. At least 44,000 IP addresses running cPanel were compromised in ongoing attacks. Hackers exploited the flaw to breach servers and deploy a Go-based Linux encryptor for a ransomware strain called &#8220;Sorry.&#8221;<\/p>\n\n\n\n<p>Two emergency Technical Support Releases in a 10-day window reflects what security teams recognize as a concentrated remediation cycle: an initial critical patch triggers a deeper audit of adjacent code paths, and that audit surfaces additional issues that were previously undiscovered or deprioritized. This is not unusual following a high-profile incident \u2014 it is actually the expected outcome of an accelerated re-examination of authentication and session handling code.<\/p>\n\n\n\n<p>In other words: finding CVE-2026-29201, 29202, and 29203 right after CVE-2026-41940 is not bad luck. It is the result of cPanel auditing their code under pressure \u2014 and finding more problems. There may be further disclosures to come.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_Patch_%E2%80%94_Step_by_Step\"><\/span>How to Patch \u2014 Step by Step<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>Standard update:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/scripts\/upcp<\/code><\/pre>\n\n\n\n<p>Run this from the command line as root after 12:00 EST on May 8. This pulls the latest TSR through cPanel&#8217;s standard tier mechanism.<\/p>\n\n\n\n<p><strong>If automatic updates are disabled or you are on a pinned tier:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/scripts\/upcp --force<\/code><\/pre>\n\n\n\n<p><strong>For CloudLinux 6 servers:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i \"s\/CPANEL=.*\/CPANEL=cl6110\/g\" \/etc\/cpupdate.conf\n\/scripts\/upcp<\/code><\/pre>\n\n\n\n<p><strong>After patching, restart cpsrvd:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/scripts\/restartsrv_cpsrvd<\/code><\/pre>\n\n\n\n<p><strong>Verify the patched version is running:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/local\/cpanel\/cpanel -V<\/code><\/pre>\n\n\n\n<p>Confirm the version matches the patched release listed in cPanel&#8217;s official security advisory before considering the server protected.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Should_You_Also_Check_for_the_Previous_Compromise\"><\/span>Should You Also Check for the Previous Compromise?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If your server was running an unpatched version of cPanel during the period between late February and April 28, you should treat it as potentially compromised and investigate, not just patch.<\/p>\n\n\n\n<p>The recommended forensic steps include: auditing access logs retroactively from February 23, 2026 \u2014 reviewing <code>\/usr\/local\/cpanel\/logs\/access_log<\/code> and <code>\/usr\/local\/cpanel\/logs\/login_log<\/code> for anomalous session authentication patterns originating from unexpected IP addresses. Also run a recursive scan of user home directories for files with the <code>.sorry<\/code> extension. Presence of <code>.sorry<\/code> files confirms ransomware deployment and requires full incident response, not just patching.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Broader_Pattern\"><\/span>The Broader Pattern<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>What is happening to cPanel right now is part of a wider trend affecting the entire web hosting security landscape.<\/p>\n\n\n\n<p>Three of the highest-profile Linux kernel vulnerabilities in years \u2014 Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284\/43500) \u2014 were disclosed within eight days of each other in late April and early May. The cPanel ransomware attack exposed over 44,000 servers. And now three more cPanel CVEs land within days of the first emergency patch.<\/p>\n\n\n\n<p>This concentration of disclosures is not coincidental. AI-assisted security research is finding vulnerabilities faster than coordinated disclosure processes can handle them. The window between a vulnerability becoming known to attackers and being exploited in production is shrinking from weeks to days. In the case of CVE-2026-41940, exploitation started months before a patch existed.<\/p>\n\n\n\n<p>For anyone operating cPanel servers, the operational implication is direct: automated updates must be on, patch verification must be part of your maintenance checklist, and log review after every major incident is no longer optional.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Summary_Checklist\"><\/span>Summary Checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Action<\/th><th>Priority<\/th><\/tr><\/thead><tbody><tr><td>Run <code>\/scripts\/upcp<\/code> to apply the May 8 TSR<\/td><td>&#x1f534; Immediate<\/td><\/tr><tr><td>Restart cpsrvd after patching<\/td><td>&#x1f534; Immediate<\/td><\/tr><tr><td>Verify patched version with <code>\/usr\/local\/cpanel\/cpanel -V<\/code><\/td><td>&#x1f534; Immediate<\/td><\/tr><tr><td>Review access logs from Feb 23 onwards<\/td><td>&#x1f7e1; Today<\/td><\/tr><tr><td>Scan for <code>.sorry<\/code> files in home directories<\/td><td>&#x1f7e1; Today<\/td><\/tr><tr><td>Enable automatic cPanel updates if disabled<\/td><td>&#x1f7e1; This week<\/td><\/tr><tr><td>Review whether any accounts may have run the <code>create_user<\/code> API anomalously<\/td><td>&#x1f7e1; This week<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The Hacker News \u2014 cPanel, WHM Release Fixes for Three New Vulnerabilities: <a href=\"https:\/\/thehackernews.com\/2026\/05\/cpanel-whm-patch-3-new-vulnerabilities.html\">https:\/\/thehackernews.com\/2026\/05\/cpanel-whm-patch-3-new-vulnerabilities.html<\/a><\/li>\n\n\n\n<li>Panelica \u2014 cPanel Pre-Discloses Three New CVEs, Second Emergency TSR in 10 Days: <a href=\"https:\/\/panelica.com\/blog\/cpanel-cve-2026-29201-29202-29203-may-2026-tsr-advisory\">https:\/\/panelica.com\/blog\/cpanel-cve-2026-29201-29202-29203-may-2026-tsr-advisory<\/a><\/li>\n\n\n\n<li>Panelica \u2014 cPanel&#8217;s 30-Day Security Storm: <a href=\"https:\/\/panelica.com\/blog\/cpanel-30-day-security-storm-2026\">https:\/\/panelica.com\/blog\/cpanel-30-day-security-storm-2026<\/a><\/li>\n\n\n\n<li>BleepingComputer \u2014 Critical cPanel flaw mass-exploited in &#8220;Sorry&#8221; ransomware attacks: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks\/<\/a><\/li>\n\n\n\n<li>BleepingComputer \u2014 cPanel, WHM emergency update fixes critical auth bypass bug: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cpanel-whm-emergency-update-fixes-critical-auth-bypass-bug\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/cpanel-whm-emergency-update-fixes-critical-auth-bypass-bug\/<\/a><\/li>\n\n\n\n<li>Help Net Security \u2014 cPanel zero-day exploited for months before patch release: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/04\/30\/cpanel-zero-day-vulnerability-cve-2026-41940-exploited\/\">https:\/\/www.helpnetsecurity.com\/2026\/04\/30\/cpanel-zero-day-vulnerability-cve-2026-41940-exploited\/<\/a><\/li>\n\n\n\n<li>KnownHost Community Forum \u2014 CVE-2026-29201, 29202, 29203 patch thread: <a href=\"https:\/\/www.knownhost.com\/forums\/threads\/cpanel-cve-2026-29201-cve-2026-29202-and-cve-2026-29203-patch-released-5-8-26-noon-est.6603\/\">https:\/\/www.knownhost.com\/forums\/threads\/cpanel-cve-2026-29201-cve-2026-29202-and-cve-2026-29203-patch-released-5-8-26-noon-est.6603\/<\/a><\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 \u2014 just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware \u2014 cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4364,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cpanel"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>cPanel&#039;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"cPanel&#039;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost\" \/>\n<meta property=\"og:description\" content=\"If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 \u2014 just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware \u2014 cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"Copahost\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-09T16:31:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-09T16:31:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gustavo Gallas\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Gustavo Gallas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\"},\"author\":{\"name\":\"Gustavo Gallas\",\"@id\":\"https:\/\/www.copahost.com\/blog\/#\/schema\/person\/386b3f1f79299d43f4ceb33d26428246\"},\"headline\":\"cPanel&#8217;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers\",\"datePublished\":\"2026-05-09T16:31:21+00:00\",\"dateModified\":\"2026-05-09T16:31:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\"},\"wordCount\":1349,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png\",\"articleSection\":[\"cPanel\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\",\"url\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\",\"name\":\"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost\",\"isPartOf\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png\",\"datePublished\":\"2026-05-09T16:31:21+00:00\",\"dateModified\":\"2026-05-09T16:31:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage\",\"url\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png\",\"contentUrl\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png\",\"width\":1536,\"height\":1024,\"caption\":\"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.copahost.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"cPanel&#8217;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.copahost.com\/blog\/#website\",\"url\":\"https:\/\/www.copahost.com\/blog\/\",\"name\":\"Copahost\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.copahost.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.copahost.com\/blog\/#organization\",\"name\":\"Copahost\",\"url\":\"https:\/\/www.copahost.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.copahost.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2016\/03\/copahostlogo.png\",\"contentUrl\":\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2016\/03\/copahostlogo.png\",\"width\":223,\"height\":40,\"caption\":\"Copahost\"},\"image\":{\"@id\":\"https:\/\/www.copahost.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.copahost.com\/blog\/#\/schema\/person\/386b3f1f79299d43f4ceb33d26428246\",\"name\":\"Gustavo Gallas\",\"description\":\"Graduated in Computing at PUC-Rio, Brazil. Specialized in IT, networking, systems administration and human and organizational development\u200b. Also have brewing skills.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/gustavo-gallas-107926196\/\"],\"url\":\"https:\/\/www.copahost.com\/blog\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/","og_locale":"en_US","og_type":"article","og_title":"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost","og_description":"If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 \u2014 just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware \u2014 cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: [&hellip;]","og_url":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/","og_site_name":"Copahost","article_published_time":"2026-05-09T16:31:21+00:00","article_modified_time":"2026-05-09T16:31:25+00:00","og_image":[{"width":1536,"height":1024,"url":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png","type":"image\/png"}],"author":"Gustavo Gallas","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Gustavo Gallas","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#article","isPartOf":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/"},"author":{"name":"Gustavo Gallas","@id":"https:\/\/www.copahost.com\/blog\/#\/schema\/person\/386b3f1f79299d43f4ceb33d26428246"},"headline":"cPanel&#8217;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers","datePublished":"2026-05-09T16:31:21+00:00","dateModified":"2026-05-09T16:31:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/"},"wordCount":1349,"commentCount":0,"publisher":{"@id":"https:\/\/www.copahost.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png","articleSection":["cPanel"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/","url":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/","name":"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost","isPartOf":{"@id":"https:\/\/www.copahost.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage"},"image":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png","datePublished":"2026-05-09T16:31:21+00:00","dateModified":"2026-05-09T16:31:25+00:00","breadcrumb":{"@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#primaryimage","url":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png","contentUrl":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/9d592da9-48e6-4f09-b972-a73a543c754a.png","width":1536,"height":1024,"caption":"cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers"},{"@type":"BreadcrumbList","@id":"https:\/\/www.copahost.com\/blog\/cpanels-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44000-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.copahost.com\/blog\/"},{"@type":"ListItem","position":2,"name":"cPanel&#8217;s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers"}]},{"@type":"WebSite","@id":"https:\/\/www.copahost.com\/blog\/#website","url":"https:\/\/www.copahost.com\/blog\/","name":"Copahost","description":"","publisher":{"@id":"https:\/\/www.copahost.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.copahost.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.copahost.com\/blog\/#organization","name":"Copahost","url":"https:\/\/www.copahost.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.copahost.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2016\/03\/copahostlogo.png","contentUrl":"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2016\/03\/copahostlogo.png","width":223,"height":40,"caption":"Copahost"},"image":{"@id":"https:\/\/www.copahost.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.copahost.com\/blog\/#\/schema\/person\/386b3f1f79299d43f4ceb33d26428246","name":"Gustavo Gallas","description":"Graduated in Computing at PUC-Rio, Brazil. Specialized in IT, networking, systems administration and human and organizational development\u200b. Also have brewing skills.","sameAs":["https:\/\/www.linkedin.com\/in\/gustavo-gallas-107926196\/"],"url":"https:\/\/www.copahost.com\/blog\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/posts\/4363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/comments?post=4363"}],"version-history":[{"count":1,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/posts\/4363\/revisions"}],"predecessor-version":[{"id":4365,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/posts\/4363\/revisions\/4365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/media\/4364"}],"wp:attachment":[{"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/media?parent=4363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/categories?post=4363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.copahost.com\/blog\/wp-json\/wp\/v2\/tags?post=4363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}