Australian organisations are being actively targeted through a critical flaw in cPanel and WHM, the control panel software that sits behind an enormous share of the world's shared hosting.
The is CVE-2026-41940, an authentication bypass caused by CRLF injection in the login and session handling. It carries a CVSS score of 9.8, which is about as bad as scoring gets. An unauthenticated attacker can reach the control panel and go on to run code on the server. Patches landed on 30 April 2026, and there is credible reporting that it was being exploited as a zero day well before that, possibly as early as February.
The detail worth pausing on is in the advisory. Products managed by several managed service providers were affected, and the result was compromise of their customers.
The part most businesses get wrong
Ask a business owner where their cyber risk sits and they will describe laptops, email and maybe the file server. Almost nobody names the website, because the website feels like marketing rather than infrastructure.
It is infrastructure. It usually runs on a machine you do not control, patched by a company you have never spoken to, sitting on the same physical host as hundreds of other tenants. When the control panel above all of that is bypassable, none of your own security decisions are in play. You did nothing wrong and you are still compromised.
What an attacker gets from that position is worth being specific about. The contents of your site database, which for many small businesses includes customer enquiries, names, phone numbers and email addresses. Any credentials stored in configuration files, which are frequently reused elsewhere. The ability to quietly modify pages, which is how legitimate Australian sites end up serving or to their own customers. And a trusted domain to send email from.
What to actually do
If you run your own cPanel or WHM instance, this is a patch-now situation and you should assume compromise if you were unpatched after late April. Rotate credentials, review accounts, check for unfamiliar cron jobs and scheduled tasks, and look at file modification times across the web root.
Most Australian businesses do not run their own, which means the useful action is a conversation rather than a technical task. Email your host or your IT provider and ask three specific things. Have you patched CVE-2026-41940, and on what date. Was our account on an affected server before that date. If yes, what did you find when you checked for compromise.
A good provider will answer all three plainly. A provider who responds with reassurance rather than dates has told you something useful anyway.
The wider lesson about outsourced risk
This is the shape of a growing number of Australian incidents. The compromise does not happen at the business. It happens at a provider two steps upstream, and it arrives already inside the trust boundary.
You cannot patch someone else's servers. You can keep a list of who holds your infrastructure, keep contacts current, ask for their patch position occasionally, and avoid keeping anything on a shared host that would hurt if it leaked. Above all, do not reuse a password between your website and anything that matters.
The website is rarely the target. It is the way in, and it is usually the part of the estate nobody has looked at in three years.
