01/05/2026
IMPORTANT NOTICE - Critical Global Vulnerability (CVE-2026-41940) in cPanel/WHM
Dear Client
* A critical global vulnerability (CVE-2026-41940) has been identified in cPanel/WHM and is being actively exploited.
* The issue affects over 1.5 million servers globally, potentially impacting hundreds of millions of websites.
* As a precaution, all cPanel servers at BAS Hosting (Pty) Ltd. have been temporarily shut down.
* No confirmed compromise has been identified within our systems based on current assessments.
* Services will be restored only after full security verification and patching is complete.
* This is a global industry issue, and our actions are proactive measures to protect all client environments.
* BAS Hosting (Pty) Ltd., operates with a clear principle: protect client systems first, restore services second.
Following the disclosure of a critical vulnerability in cPanel & WHM (CVE-2026-41940), we have taken the deliberate decision to temporarily shut down all cPanel-based servers within our infrastructure.
This action is preventive, controlled, and in the best interest of all clients.
Incident Overview
* A recently disclosed vulnerability in cPanel/WHM (CVE-2026-41940) has been classified as critical, with confirmed reports of active exploitation in the wild.
The vulnerability enables:
* Authentication bypass (unauthorized access without valid login credentials)
* Potential privileged-level control of affected servers
* Broad impact across multi-tenant hosting environments
* Industry-wide assessments indicate that over 1.5 million cPanel servers may be exposed globally. Given that each server can host hundreds to thousands of websites, the potential impact extends to Hundreds of millions of websites worldwide.
* This is a systemic software-level vulnerability, affecting hosting providers globally, irrespective of size or internal security standards.
Industry Context
* This vulnerability has been widely reported and analyzed by leading cybersecurity firms and global security media, highlighting the severity and urgency of the situation.
* Rapid7 — Critical cPanel & WHM Authentication Bypass (CVE-2026-41940)
* Labs @ WatchTowr — The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
* BleepingComputer — Critical cPanel bug exploited as zero-day before patch release
* SecurityWeek — cPanel vulnerability exploited as zero-day for months
* Bitsight — Critical vulnerability alert: cPanel WHM authentication bypass
Key findings from these reports include:
* CVSS 9.8 (critical severity rating).
* Active exploitation in the wild.
* No authentication required for attack.
* Potential full administrative control of servers.
* Given the widespread adoption of cPanel, this is considered one of the most impactful control panel–level security incidents in recent times.
Risk in Shared Hosting Environments
In cPanel-based shared hosting architectures, a successful exploit at the control panel layer may allow attackers to:
* Access or manipulate website files and databases.
* Compromise email systems and credentials.
* Inject malicious code or redirect traffic
* Leverage servers for spam or coordinated attacks
* Given the multi-account nature of shared hosting, a single compromised server can have cascading effects across multiple client environments.
Our Decision: Full Shutdown of cPanel Servers
After internal risk evaluation, we have elected to:
* Fully shut down all cPanel servers as a precautionary measure.
This approach ensures:
* Reduced exposure window during active exploitation.
* Reduce containment of potential attack vectors.
* Maximum protection of client data integrity.
While this results in temporary service interruption, it reflects a security-first operating model aligned with best practices for high-severity incidents.
Responsibility & Transparency
We want to state this clearly:
* This issue originates from a 3rd party software vulnerability within cPanel/WHM and is affecting hosting providers globally.
* It originates from a core vulnerability within cPanel/WHM software.
* It is affecting hosting providers globally across all regions
At present:
* At this time, our investigations are ongoing, and we are actively reviewing all systems as part of our security assessment.
* All actions taken are proactive and aligned with industry best practices for risk mitigation under active threat conditions.
Remediation & Ongoing Actions
Our engineering and security teams are actively engaged in:
* Deploying official vendor patches and verified updates and reload/reboot server as needed.
* Conducting comprehensive system integrity audits.
* Reviewing logs and access patterns for anomalies.
* Implementing additional hardening controls and access restrictions.
* Systems will only be brought back online once they meet our internal security clearance standards.
Service Restoration
Service restoration will proceed in a phased and controlled manner once:
* All affected systems are fully patched.
* Security validation checks are completed.
* Residual risk is reduced to an acceptable level.
Our approach prioritizes long-term system integrity over short-term availability.
Strategic Outlook
* This event reinforces the importance of continuous infrastructure evolution.
BAS Hosting (Pty) Ltd. is actively:
* Diversifying control panel dependencies.
* Strengthening multi-layered security architecture.
* Enhancing resilience against platform-level vulnerabilities.
Client Commitment
* We recognize the impact of this temporary disruption and sincerely appreciate your patience.
* Our responsibility extends beyond uptime — it includes ensuring that your systems remain:
* Secure, stable, and uncompromised
* We will continue to provide updates as progress is made.
Support Channels
For urgent matters, our support teams remain available WhatsApp or phone calls.
Regards
BAS Hosting Support
