The makers of the popular web server management software cPanel and WebHost Manager (WHM) have alerted users of a critical flaw in their software, which allows hackers to gain control of thousands of websites using the vulnerable software. As of Monday, there are over 550,000 potentially vulnerable servers running cPanel, a number that has remained stable for days. There are now around 2,000 instances likely compromised, down from around 44,000 on Thursday. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that the vulnerability, identified as CVE-2026-41940, is being exploited in the wild and added it to its Known Exploited Vulnerabilities (KEV) catalog. The attacks likely have been ongoing since much earlier than the vulnerability was disclosed.