CVE-2026-41940 - Critical cPanel Vulnerability Exploited in Mr_Rot13 Backdoor Campaign

Researchers at QiAnXin XLab have attributed an active exploitation campaign against a critical cPanel authentication bypass vulnerability (CVE-2026-41940) to a long-running threat actor dubbed Mr_Rot13.

The campaign deploys a cross-platform backdoor named Filemanager that steals credentials and establishes persistent access across compromised Linux hosting environments.

More than 2,000 attacker source IPs worldwide have been observed conducting automated attacks against CVE-2026-41940 since its public disclosure on April 28, 2026.

Exploitation activity includes cryptocurrency mining, ransomware deployment, botnet propagation, and backdoor implantation.