CVE-2026-41940: Massive cPanel Exploit Campaign Linked to 'Mr_Rot13' Actor

Researchers have identified a widespread campaign exploiting a critical cPanel authentication bypass (CVE-2026-41940). The threat actor, known as Mr_Rot13, is…

CVE-2026-41940: Massive cPanel Exploit Campaign Linked to 'Mr_Rot13' Actor

On May 12, 2026, researchers from QiAnXin XLab disclosed an ongoing cyberattack campaign exploiting a critical vulnerability, CVE-2026-41940, in cPanel and WHM to deploy the Filemanager backdoor. The threat actor, identified as Mr_Rot13, leverages an authentication bypass within the control panel's session management layer, effectively escalating unauthenticated sessions into valid administrative access. Technical analysis confirms that shared hosting infrastructures—often overlooked compared to corporate targets—are being utilized as platforms for multi-OS persistent espionage.

Key Takeaways
  • The CVE-2026-41940 vulnerability affects cPanel and WHM versions later than 11.40 and carries a CVSS score of 9.8. It involves a code path handling Basic authentication that writes to disk without the input sanitization found in alternative flows, allowing unauthenticated sessions to be treated as valid.
  • The threat actor Mr_Rot13 utilizes a shell script to fetch a Go-based infector (part of the Payload project) to install unauthorized SSH keys, PHP web shells, and the cross-platform Filemanager backdoor.
  • Researchers have identified over 2,000 attacking IPs concentrated in Germany, the United States, Brazil, and the Netherlands. The automated campaign injects malicious JavaScript into cPanel login pages to harvest credentials.
  • Stolen data—including bash histories, database passwords, and valiases files—is exfiltrated to an attacker-controlled Telegram group. The domain wrned[.]com, used for credential harvesting, has been registered since October 2020.

Anatomy of the Bypass: Flawed Session Management Paths

The CVE-2026-41940 vulnerability stems from how cPanel and WHM manage sessions during Basic authentication handling. According to technical documentation released by cPanel, the system utilizes two distinct code paths for processing requests. One of these paths writes session information to disk without the rigorous input sanitization present in the other. By submitting a specially crafted request, an attacker can force the system to validate an unauthenticated session, completely bypassing credential requirements.

The National Vulnerability Database has assigned the flaw a CVSS score of 9.8. On April 30, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, setting a May 3, 2026, deadline for federal agencies to apply mitigations. cPanel released security updates on April 28, 2026, approximately 28 hours after the vulnerability was confirmed. While the vendor claims that over 98% of managed servers have been updated, this figure remains unverified by independent sources at the time of publication.

The Go-Based 'Payload' and the Filemanager Backdoor

On May 4, 2026, while analyzing payloads delivered via CVE-2026-41940, QiAnXin XLab researchers isolated a unique component: a shell script that retrieves a Go-compiled infector from the project "Payload," hosted on the domain cp.dene[.]de.com. Once executed, the binary installs unauthorized SSH keys, PHP web shells, and the Filemanager backdoor, ensuring cross-platform persistence that operates outside the standard cPanel authentication perimeter.

"Monitoring data shows that more than 2,000 attacker source IPs worldwide are currently involved in automated attacks and cybercrime activities targeting this vulnerability" — QiAnXin XLab researchers via The Hacker News

The Go infector contains a significant volume of log messages in Turkish, which researchers suggest may be generated by automated tools, though this remains speculative. The Filemanager backdoor extends beyond simple remote control; the malicious code injects JavaScript into the cPanel login page to intercept usernames and passwords. This data is encoded using ROT13 and sent to wrned[.]com. Once harvested, the credentials and other sensitive data—including configuration files and command histories—are funneled to an attacker-controlled Telegram group.

Infrastructure Dating Back to 2020: The Long Game of Mr_Rot13

The infrastructure revealed by QiAnXin XLab suggests an unusually long operational timeline for a threat actor active in the shared hosting ecosystem. The domain wrned[.]com, currently used for credential harvesting, was registered in October 2020. This is not an isolated data point: a PHP backdoor sample named helper.php, linked to the same infrastructure, was uploaded to VirusTotal as early as April 2022, exhibiting a negligible detection rate by security products at that time.

This continuity explains how the group has remained under the radar for so long. Researchers note that over the nearly six-year period since 2020, the detection rate for samples and infrastructure associated with Mr_Rot13 has remained extremely low. It is currently unknown if the group operates under a specific geographic or political mandate; the only contextual clues are the language used in the malware and the longevity of the domains, which are insufficient for definitive attribution.

Mitigation and Incident Response

  • Immediate Patching: Confirm that cPanel/WHM instances are running a patched version released on or after April 28, 2026, addressing CVE-2026-41940. While CISA mandated a May 3 deadline for US government infrastructure, the risk remains high for any unpatched server.
  • Post-Compromise Auditing: Inspect the filesystem for PHP web shells, unauthorized SSH keys, and the Go binary associated with the "Payload" project, using Indicators of Compromise (IoCs) published by watchTowr and cPanel.
  • Frontend Verification: Check for unauthorized modifications to cPanel and WHM login page templates, where credential-harvesting JavaScript may have been injected.
  • Traffic Monitoring: Alert network monitoring systems for activity involving wrned[.]com and cp.dene[.]de.com, as well as outbound communications to Telegram, which may indicate the exfiltration of bash histories and database passwords.

Shared Hosting as a Strategic Target

The operation documented on May 12, 2026, challenges the assumption that advanced threat actors focus exclusively on large enterprises or cloud infrastructure. Mr_Rot13 has demonstrated that a low-intensity, highly resilient model—built on aged domains and low detection rates—can extract significant value from shared hosting servers. In these environments, the fragmentation of responsibility between providers and customers often leads to critical delays in patching.

For providers, the lesson is clear: patch speed is vital, but it is not a complete solution. Once an authentication bypass allows initial access, tools like the Filemanager backdoor and PHP web shells can survive reboots and migrations. The cross-platform persistence of the Go infector indicates that defense perimeters must extend beyond the control panel to include monitoring of the underlying operating system and outbound traffic.

FAQ

What distinguishes Mr_Rot13 from other actors targeting cPanel?
The primary differentiator is the actor's extremely low detection rate since 2020, combined with the use of infrastructure registered years in advance and reused across multiple campaigns without operational disruption.
Is the cPanel patch sufficient to neutralize the threat?
The update closes the vulnerability, but already compromised systems require post-incident scanning to remove persistent backdoors, web shells, and SSH keys installed via the Go infector.
Why does the malware use ROT13 for credential encoding?
ROT13 is a basic encoding scheme that, while not providing real encryption, can bypass simple detection filters. The group's name, Mr_Rot13, appears to be a reference to this stylistic choice found throughout their infrastructure.

Information has been verified against cited sources and is current as of the date of publication.

Sources