A single attacker was probably exploiting the cPanel authentication bypass CVE-2026-41940 as a zero-day for at least 25 days before the vendor disclosed it, according to a new CrowdStrike retrospective. The finding, published on 5 November 2026, turns a flaw many hosting teams filed away as an April problem into a warning about how fast public vulnerability research now turns into live attacks.

CrowdStrike's report, titled "Adversaries Turn the Vulnerability Ecosystem Against Defenders", was written by senior intelligence analysts Jaime Duque and Lacie Blythe and presented at Day Zero 2026. It studied exploitation that CrowdStrike's Counter Adversary Operations team observed between January and July 2026, and its headline numbers are stark. Of the vulnerabilities it saw exploited where a public proof of concept existed, 91 percent were attacked within 48 hours of the proof of concept appearing. The median time from public proof of concept to exploitation was less than a day, and the fastest case CrowdStrike observed took just 35 minutes.

What CVE-2026-41940 is

CVE-2026-41940 is an authentication bypass in cPanel and WHM, the web hosting control panel used by hosting providers around the world, and in WordPress Squared, the WordPress-focused product built on the same stack. It affects cPanel and WHM releases after version 11.40. An unauthenticated remote attacker could gain unauthorised access to affected control panels, taking control of the websites, email and databases managed through them.

cPanel disclosed the flaw and shipped fixes across its supported branches on 28 April 2026. Singapore's Cyber Security Agency still lists the bug as actively exploited, and hosting operators are told to patch and then investigate for signs of earlier compromise.

The timeline CrowdStrike reconstructed

The retrospective puts the earliest supported exploitation on 3 April 2026, when a single threat actor likely began using the flaw in the wild. That is 25 days before cPanel's 28 April disclosure, which means the attacker was inside vulnerable systems while the vendor, and every hosting team running the software, still believed the code was safe.

The picture changed sharply once the flaw became public. On 29 April, the day after disclosure, watchTowr Labs published a technical analysis of the authentication bypass together with a detection-artifact generator meant to help defenders find vulnerable instances. CrowdStrike analysed that generator and found that a minor code change could turn it into a working exploit, one capable of changing the root password and reaching the WHM terminal with root privileges.

On 30 April, CrowdStrike began observing widespread, opportunistic exploitation of CVE-2026-41940. Most, if not all, of the exploitation it subsequently observed followed techniques described in the published research. CrowdStrike did not determine how the original attacker discovered the flaw or obtained an exploit, and the distinction matters: public disclosure did not necessarily trigger the first attack, but the technical publication that followed almost certainly drove the surge that came after it.

Why the case matters for patching

The cPanel case is the report's clearest example of a zero-day becoming an n-day flaw in front of defenders. Before disclosure, exploitation was targeted and limited in scope. After disclosure and the publication of technical detail, exploitation spread quickly to multiple threat actors. The lesson CrowdStrike draws is that the window between a fix being available and attackers weaponising the underlying research is now measured in hours, not weeks.

For hosting providers and server administrators, the practical steps have not changed, but the urgency has. Any cPanel or WHM server still running an unpatched release should be updated to the fixed builds cPanel shipped on 28 April, and administrators should review access logs for unusual logins or new accounts created during the exposure window. A patch applied late leaves the same door open that the first attacker walked through in early April, and the CrowdStrike figures show that later attackers do not wait long to follow.

CrowdStrike's wider analysis, also covered by CXO Today, found the same pattern across the vulnerabilities it tracked in the first seven months of 2026: once exploit detail is public, attacks follow within hours. The cPanel zero-day shows the other side of that coin. Even before anything was public, one attacker was already in.