cPanel patches three new high-severity vulnerabilities on May 8, 2026, ten days after CVE-2026-41940 ransomware attack compromised 44,000 servers; code audit reveals arbitrary file read, Perl code execution, and privilege escalation flaws

cPanel's Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers - Copahost

If you run a server with cPanel or WHM, you need to read this carefully.On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203.Two of the three carry a CVSS score of 8.8. That puts them firmly in the High severity tier, one step below Critical...