Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Threat Brief: CVE-2026-41940: Critical cPanel & WHM Authentication Bypass Actively Exploited in the Wild
Excerpt
Executive Summary CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM, including DNSOnly, and WP Squared. The issue affects cPanel software versions after 11.40 and can allow an unauthenticated remote attacker to gain unauthorized access to exposed hosting control panels. cPanel released patched versions and published official remediation and detection guidance. Cato has observed exploitation attempts in the wild and has virtually…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 104.234.140.18 | High | Score 58/100 | First seen |
| IP | 104.234.140.30 | High | Score 58/100 | First seen |
| IP | 108.131.133.224 | High | Score 58/100 | First seen |
| IP | 104.234.140.28 | High | Score 58/100 | First seen |
| IP | 24.144.95.61 | High | Score 58/100 | First seen |
| CVE | CVE-2026-41940 | High | Score 77/100 | First seen |
| IP | 146.190.146.169 | High | Score 58/100 | First seen |
| IP | 104.234.140.13 | High | Score 58/100 | First seen |
| IP | 134.199.225.24 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…