CVE-2026-41940

This CVE / Exploit Watch Brief is written for vulnerability-management teams, hosting providers, MSPs, SOC and incident-response teams, cyber insurers, breach counsel, and SMB-facing advisors. It emphasizes immediate exposure validation, patch status, exploitation evidence, detection steps, and plain-language client communication for organizations that may not operate cPanel directly but rely on a hosting provider that does. ^{3 6 7}

• CVE-2026-41940 is a critical cPanel & WHM / WP Squared authentication bypass with CVSS 9.8 severity and no required credentials or user interaction. ^{1 3 6 13}
• Target discovery can happen before formal reconnaissance through commodity exposure enumeration: common cPanel/WHM hostnames, ports, service fingerprints, provider patterns, passive attack-surface data, and scanning. ^{3 6 10 17}
• This is not a WordPress vulnerability and is not limited to WordPress. It affects the hosting control panel layer used to manage websites, CMS platforms, databases, mail, domains, files, and customer accounts; WordPress sites are one common downstream exposure path. ^{3 13 17 18}
• 28-Jun-2026 · Newly retained (>24h) CISA's official KEV feed records April 30, 2026 as the catalog-addition date, with a May 3 due date and known ransomware-campaign-use flag; cPanel's response separately references May 1 confirmation. Public reporting describes active exploitation, including Sorry ransomware follow-on activity. ^{2 4 7}
• The vulnerability affects cPanel & WHM versions after 11.40 before the applicable fixed builds; WP Squared is fixed at 136.1.7 and later. ^{3 13}
• watchTowr published technical analysis and PoC after vendor patches became available, materially increasing exploit reproducibility. ^{5 6}
• 28-Jun-2026 · Newly retained (>24h) Newly retained defense-side evidence adds Cloudflare emergency WAF rule coverage and Shadowserver compromised-website report tags for sorry-ransomware, whmstealer, and mr-rot13 patterns. ^{23 24}
• 29-Jul-2026 · Newly retained (>24h) Imperva adds bounded WAF/customer-telemetry evidence: nearly 4,000 attack requests observed across 15 industries and 17 countries, with US sites accounting for almost 70% of observed attacks. ⁴⁰
• 13-Jul-2026 · Newly retained (>24h) Proofpoint adds network-telemetry context that CVE-2026-41940 exploitation followed a multi-actor mass-exploitation pattern and appeared in compromised-website web-inject chains such as TA569/SocGholish. ²⁹
• 22-Jul-2026 · Newly retained (>24h) Coalition Security Labs adds insurer/policyholder coordination evidence: impacted policyholders were notified, provider patch progress should be tracked, and on-premises cPanel/WHM remediation needs direct evidence. ³⁷
• 24-Jul-2026 · Newly retained (>24h) Socket adds a new activity-cluster lens: compromised GitHub repositories and GitHub-hosted Actions runners were abused as distributed CVE-2026-41940 scanning/exploitation and credential-harvesting infrastructure, while Packagist development versions were exposure artifacts rather than the execution path. ³⁸
• 27-Jul-2026 · Newly retained (>24h) ASD's ACSC adds national-CERT scoping evidence: active exploitation was observed in Australia, and several MSP-managed products were reportedly impacted with customer compromise, but no named victim organization list was published. ³⁹
• 18-Aug-2026 · Newly retained (>24h) Government of Guam/BSP remains the retained named public victim/disclosure row tied to the cPanel-hosted CVE-2026-41940 compromise path; DysruptionHub's August 16 update now treats the incident as presumed resolved after BSP's restoration warning disappeared and reports/data pages were repopulated, while still preserving no government-wide all-clear, exact final restoration date, confirmed data theft, ransomware finding, or actor attribution. ^{42 43 44}
• 13-Aug-2026 · Newly retained; undated Shadowserver's current dashboard row still shows bounded CVE-2026-41940 exploit pressure: 98 last-day unique IPs, 134 seven-day average, 164 thirty-day average, 259 ninety-day average, and known ransomware-campaign-use flag. Freshness: Newly retained (publication date not visible). ⁴¹
• 11-Aug-2026 · Newly retained (>24h) China Daily / CCTV News Client reporting attributed to the National Computer Virus Emergency Response Center adds China-focused Sorry ransomware activity detail: multiple domestic attacks against internet-exposed Linux web servers, cPanel/CVE-2026-41940 initial access, sshd process masquerading, data theft, AES/RSA encryption, and weak-password SSH lateral-movement risk. ⁴⁵
• For exposed systems, patching is necessary but not sufficient: run the vendor detection script, review session/access logs, scope administrator activity, and check for ransomware or web-host compromise. ^{3 4 7}

CVE-2026-41940 is a critical authentication bypass in cPanel & WHM and WP Squared. The vendor describes it as a session-management vulnerability in which one code path that writes session files lacked the sanitization applied elsewhere; under a specially crafted request, an unauthenticated session could be treated as authenticated. The public risk is severe because cPanel & WHM commonly sits on internet-facing hosting infrastructure and can control hosted websites, databases, email, reseller accounts, and server configuration. ^{3 4 6}

The attacker story is straightforward enough for non-technical stakeholders: find an exposed cPanel/WHM service, send a crafted pre-authentication request that manipulates session state, reach privileged control panel functionality, and then use that access to change hosting accounts, alter sites, access databases or files, plant webshells, or deploy ransomware. This is why the brief treats the CVE as a hosting control-plane compromise risk rather than a narrow website bug. ^{4 5 6 7 11}

The “find an exposed service” step is not magic. Threat actors can discover candidate targets through internet-wide scanning, common cPanel/WHM hostnames, common management ports, HTTP and TLS fingerprints, hosting-provider patterns, passive attack-surface data, or target lists when those are present in a particular investigation. WP Squared, also referenced as WP2 in vendor materials, is a WebPros/cPanel product in the affected product family and should be scoped as hosting-control-plane exposure rather than as a WordPress core, plugin, or theme issue. ^{3 6 10 17}

The WordPress connection needs to be stated carefully. cPanel & WHM is a widely used web-hosting control panel for managing websites, CMS platforms, databases, email, domains, files, customer accounts, and server administration. WordPress is a common workload managed through cPanel, but CVE-2026-41940 is not a WordPress vulnerability and not limited to WordPress. Successful exploitation can endanger any hosted assets managed through the same control plane. ^{6 11 17 18}

The exploitation picture is mature enough for emergency handling. cPanel released fixes on April 28, watchTowr published root-cause analysis and PoC on April 29, 28-Jun-2026 · Newly retained (>24h) CISA's official KEV feed records an April 30 catalog addition, May 3 due date, and known ransomware-campaign-use flag, while cPanel's response references May 1 confirmation. BleepingComputer reported exploitation tied to Sorry ransomware on May 2. Shadowserver also reported at least 44,000 likely compromised IPs seen scanning honeypots. ^{2 5 7 8}

26-Jun-2026 · Newly retained (>24h) AI Monitoring Agent run at June 26, 2026 10:02 AM ET retained three older-but-new-to-this-brief deltas: NVD's June 17 official metadata update, Censys activity-cluster telemetry for Mirai-pattern and .sorry ransomware activity, and Ctrl-Alt-Intel's named public targeting report involving CVE-2026-41940 PoC use.^{1 20 21}

27-Jun-2026 · Newly retained (>24h) AI Monitoring Agent run at June 27, 2026 10:02 AM ET retained QiAnXin XLab's May 11 Mr_Rot13/Filemanager reporting as a source-backed activity-cluster delta. The update adds backdoor, credential-theft, webshell, and persistence hunting guidance without publishing raw attacker payload infrastructure and without converting aggregate compromise activity into a named-victim list.²²

28-Jun-2026 · Newly retained (>24h) AI Monitoring Agent run at June 28, 2026 10:02 AM ET retained older defense-side deltas: Cloudflare's April 30 emergency WAF release for CVE-2026-41940 and Shadowserver's compromised-website report tags for sorry-ransomware, whmstealer, and mr-rot13 patterns. These add mitigation/reporting workflow guidance and do not create a named-victim list. Freshness: Newly retained (>24h).^{23 24}

01-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 1, 2026 10:02 AM ET retained older hosting-provider disclosure evidence: Liquid Web's public status incident for CVE-2026-41940 remediation and InMotion Hosting's fleet-response report. These sources improve provider-notice, customer-scoping, and remediation-pattern guidance, while preserving the boundary that they are not a raw named end-customer victim list. Freshness: Newly retained (>24h).^{25 26}

30-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 30, 2026 10:04 AM ET retained Liquid Web's later status-incident updates as older-but-useful provider-remediation evidence: the incident moved to monitoring on July 21 after all known affected systems had been addressed or were actively being addressed, then was marked resolved on July 23. Freshness: Newly retained (>24h).²⁵

03-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 3, 2026 10:03 AM ET retained ThreatLocker's May 15 Sorry ransomware analysis as an older-but-useful detection and recovery delta. The update strengthens bounded ransomware hunting for host-level markers, service/process disruption, SSH propagation attempts, and recovery scoping, without adding exploit instructions, raw victim lists, or a universal compromise assumption. Freshness: Newly retained (>24h).²⁷

08-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 8, 2026 10:03 AM ET retained Unfold Security's May 6 detection research as an older-but-useful detection-engineering delta. The update adds behavior-based session and access-log correlation guidance while avoiding raw exploit payloads, raw rule bodies, and brittle PoC-string-only detection framing. Freshness: Newly retained (>24h).²⁸

13-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 13, 2026 10:03 AM ET retained Proofpoint's May 27 network-telemetry report as an older-but-useful activity-cluster delta. Proofpoint frames CVE-2026-41940 as multi-actor mass exploitation and reports that the vulnerability is increasingly observed in compromised-website web-inject chains such as TA569/SocGholish. Freshness: Newly retained (>24h).²⁹

17-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 17, 2026 10:11 AM ET retained Bluehost's July 9 provider guidance and May 6 compromise-check guide as older-but-useful provider/customer-notice deltas. The update adds Bluehost to the named provider response pattern, strengthens VPS/Dedicated and CentOS 6 scoping, and captures provider-published compromise-review categories without republishing raw command bodies or hashes. Freshness: Newly retained (>24h).^{30 31}

19-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 19, 2026 10:04 AM ET retained InMotion Hosting's May 20 direct customer follow-up and BinaryLane's May 5 provider advisory as older-but-useful provider-response deltas. The update strengthens port-blocking, patch exception, customer outreach, unmanaged-VPS, detection-script, credential/log/account review, and provider-attestation scoping without adding a new named end-customer victim list, actor, ransomware family, or exploit instructions. Freshness: Newly retained (>24h).^{32 33}

20-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 20, 2026 10:02 AM ET retained CrowdSec's May 4 telemetry/detection report, Beazley Security's insurer-adjacent advisory, and KnownHost's April 28-30 provider response thread as older-but-useful deltas. The update adds bounded reconnaissance telemetry, WAF virtual-patching and detection-control evidence, insurer/MDR scoping language, and direct provider port-blocking/log-review detail without adding a named end-customer victim list or raw exploit/log examples. Freshness: Newly retained (>24h).^{34 35 36}

22-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 22, 2026 10:03 AM ET retained Coalition Security Labs' May 1 insurer/security advisory as an older-but-useful policyholder coordination delta. Coalition says it notified impacted policyholders, worked with them to track hosting-provider patch progress, and helped on-premises cPanel/WHM policyholders remediate. Freshness: Newly retained (>24h).³⁷

24-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 24, 2026 10:02 AM ET retained Socket's July 22 GitHub Actions abuse research as an older-but-useful activity-cluster delta. Socket reports compromised repositories and GitHub-hosted runners used to scan for and attempt CVE-2026-41940 exploitation against cPanel/WHM targets and harvest server-side credentials; this adds CI/CD and software-supply-chain scoping without treating Packagist installation as the execution path. Freshness: Newly retained (>24h).³⁸

27-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 27, 2026 10:03 AM ET retained ASD's ACSC May 1 alert as older-but-useful national-CERT evidence. ACSC reported active exploitation in Australia and warned that several MSP-managed products had been impacted with customer compromise; this strengthens provider/MSP scoping and third-party assurance questions without naming public victim organizations or changing product version/fixed-build guidance. Freshness: Newly retained (>24h).³⁹

29-Jul-2026 · Newly retained (>24h) AI Monitoring Agent run at July 29, 2026 10:02 AM ET retained Imperva's April 30 threat-research note as older-but-useful telemetry and compensating-control evidence. Imperva reported nearly 4,000 attack requests against customer environments across 15 industries and 17 countries, with US sites accounting for almost 70% of observed attacks, while still directing defenders to patch and review cPanel session/access evidence. Freshness: Newly retained (>24h).⁴⁰

03-Aug-2026 · Newly retained (>24h) AI Monitoring Agent run at August 3, 2026 10:03 AM ET retained Government of Guam and Guam Bureau of Statistics and Plans public disclosure evidence, plus DysruptionHub's reconciled incident profile, as a named victim/disclosure delta. The evidence supports cPanel-hosted government website disruption, bsp.guam.gov compromise, and ongoing BSP file/content restoration; it does not confirm sensitive personal-information breach, ransomware encryption, ransom demand, leak threat, named actor attribution, or a public raw victim/customer list. Freshness: Newly retained (>24h) for the May 2 official statement and DysruptionHub profile; Newly retained (publication date not visible) for the BSP restoration notice.^{42 43 44}

09-Aug-2026 · Newly retained; undated AI Monitoring Agent run at August 9, 2026 10:01 AM ET retained Shadowserver's embedded August 8 exploited-vulnerabilities dashboard row as a bounded current exploit-pressure update. The row shows CVE-2026-41940 at rank 14 with 151 last-day unique IPs, 190 seven-day average, 167 thirty-day average, 266 ninety-day average, 1,099 connections, KEV status, and known ransomware-campaign-use flag. Freshness: Newly retained (publication date not visible). This does not add a named victim organization, new actor, new ransomware family, intrusion set, botnet, exploit wave, public PoC-driven campaign name, or successful-compromise count.⁴¹

11-Aug-2026 · Newly retained (>24h) AI Monitoring Agent run at August 11, 2026 10:02 AM ET retained China Daily / CCTV News Client reporting attributed to the National Computer Virus Emergency Response Center and National Engineering Laboratory. The warning says multiple domestic Sorry ransomware attacks in China targeted internet-exposed Linux web servers and used the WebPros cPanel authorization-bypass vulnerability CNNVD-202604-5641 / CVE-2026-41940 for initial access before process masquerading, victim/environment profiling, service and backup disruption, data theft, AES/RSA file encryption, and weak-password SSH lateral movement. Freshness: Newly retained (>24h). This adds a China-focused activity-cluster and defensive-scoping delta, not a named victim list, new ransomware family, or universal payload path.⁴⁵

13-Aug-2026 · Newly retained (>24h) AI Monitoring Agent run at August 13, 2026 10:03 AM ET retained DysruptionHub's August 10 Government of Guam/BSP status update as a named victim/disclosure revision. The update keeps the incident active, says BSP downloads and embedded content were still unavailable while the agency re-uploaded files and datasets, and preserves the boundary that no government-wide all-clear, confirmed data theft, ransomware finding, or actor attribution had been published. Freshness: Newly retained (>24h).^{42 43 44}

18-Aug-2026 · Newly retained (>24h) AI Monitoring Agent run at August 18, 2026 10:01 AM ET retained DysruptionHub's August 16 Government of Guam/BSP recovery-status revision as an older-than-24-hour victim/disclosure update. DysruptionHub now treats the incident as presumed resolved because BSP's restoration warning was no longer visible on core BSP pages and reports/data pages were repopulated, while preserving that no government-wide all-clear, exact final restoration date, confirmed data theft, ransomware finding, or actor attribution had been published. Freshness: Newly retained (>24h).⁴⁴

13-Aug-2026 · Newly retained; undated The same August 13 run retained Shadowserver's current exploited-vulnerabilities dashboard row as bounded current exploit-pressure telemetry: 98 last-day unique IPs, 134 seven-day average, 164 thirty-day average, 259 ninety-day average, and known ransomware-campaign-use flag. Freshness: Newly retained (publication date not visible). This does not add a named victim organization, new actor, new ransomware family, intrusion set, botnet, exploit wave, public PoC-driven campaign name, or successful-compromise count.⁴¹

For US SMBs, the risk is often indirect but still urgent. Many small businesses do not administer WHM themselves; they rely on a web host, MSP, reseller, or agency. 27-Jul-2026 · Newly retained (>24h) ACSC's Australia-facing alert reinforces this indirect-risk pattern by warning that several MSP-managed products were impacted and customers should confirm provider patching and monitoring. Those stakeholders should validate whether any cPanel/WHM or WP Squared environment is internet-facing, patched to a fixed build, scanned with the vendor detection script, and reviewed for post-exploitation activity including Sorry ransomware, data theft, backup/service disruption, and SSH lateral-movement evidence where relevant. ^{3 6 10 25 26 30 31 35 36 37 39 45}

For insurers, brokers, breach counsel, and MSPs, the practical question is not only “does the policyholder run WordPress?” or “what CMS does the site use?” It is “does the policyholder, host, reseller, MSP, or web agency use cPanel/WHM or WP Squared to operate the insured web, mail, database, or customer-hosting environment?” External attack-surface checks can identify probable cPanel exposure, but they cannot prove patch status or absence of compromise; that requires provider attestation, version evidence, vendor detection-script output, retained logs, hosted-asset review, and where applicable insurer or broker tracking of provider remediation progress. ^{3 6 10 17 18 35 37}

Decision-makers should avoid treating this as a routine patch notice. KEV status, public exploit details, ransomware reporting, and exposed-hosting blast radius make this an exposure-validation and incident-scoping problem. Patching closes the known flaw, but response should also preserve logs, inspect session artifacts, rotate affected administrative credentials where warranted, and confirm hosted-site integrity. ^{3 4 7}

cPanel & WHM is not just another web application on a host. In many environments, it is the management layer for websites, databases, email, DNS-adjacent workflows, reseller access, and server administration. An authentication bypass against that control plane can become a customer-impacting event quickly, especially for hosting providers, MSPs, agencies, and SMBs that share infrastructure or depend on a third party for web operations. ^{6 11 12}

That distinction matters for scoping. A website owner may not have a flaw in WordPress, Joomla, Drupal, Magento, custom code, or another hosted application to patch, but still needs assurance from the hosting provider, MSP, reseller, or web agency that the cPanel/WHM control plane was patched and checked for exploitation. This is a hosting-control-plane risk with downstream website and hosted-service consequences.^{3 17 18}

26-Jun-2026 · Newly retained (>24h) Newly retained telemetry adds that Censys observed a May 1 malicious-host surge overwhelmingly concentrated on cPanel/WHM, plus distinct Mirai-pattern and .sorry ransomware activity signals. This improves activity scoping but does not create a public named-victim list.²⁰

01-Jul-2026 · Newly retained (>24h) Newly retained hosting-provider notices show why customers need provider-specific evidence instead of only generic CVE status: Liquid Web publicly described CVE-2026-41940-related remediation, support-volume impact, and restoration where compromise was evident, while InMotion reported network-edge blocking, fleet patching, and direct work with a small subset of customer environments. Freshness: Newly retained (>24h).^{25 26}

30-Jul-2026 · Newly retained (>24h) Liquid Web's later status updates add provider-remediation closure context: normal support operations had resumed by the July 21 monitoring update, and the incident was marked resolved on July 23. Freshness: Newly retained (>24h).²⁵

17-Jul-2026 · Newly retained (>24h) Bluehost adds another named provider-response example for VPS and Dedicated customers: temporary cPanel/WHM/Webmail/WebDisk port restrictions on affected servers, CentOS 6 migration guidance, backup and log-review advice, and compromise-review categories for ransomware markers, persistence, SSH keys, cPanel template tampering, shell history, credential rotation, and hosted-account review. Freshness: Newly retained (>24h).^{30 31}

19-Jul-2026 · Newly retained (>24h) InMotion's direct follow-up and BinaryLane's advisory add provider-response detail that customers can request from hosts: port-blocking windows, patch exception handling, direct customer outreach, unmanaged VPS responsibilities, credential rotation, log/account review, and detection-script execution. Freshness: Newly retained (>24h).^{32 33}

Before exploitation, the attacker still has to find candidate cPanel/WHM or WP Squared endpoints. That is usually not luck. Publicly reachable hosting-control panels can be located through internet-wide scanning, common hostnames such as cpanel, whm, and webmail, common cPanel ports such as 2082/2083, 2086/2087, and 2095/2096, HTTP titles, TLS certificates, provider fingerprints, passive attack-surface datasets, and known hosting-provider or reseller patterns. Underground or shared target lists can also exist in real incidents, but this brief treats internet exposure discovery and attack-surface enumeration as the source-supported baseline unless a source proves a specific list-driven campaign. ^{3 6 10 17}

At a defensive level, the public technical record points to a pre-authentication path in which attacker controlled input can influence cPanel session-file state. cPanel describes two code paths writing session files, one of which lacked sanitization during Basic authentication handling. Rapid7 and watchTowr describe the exploitability around CRLF injection, malformed session material, and the ability to insert privileged session properties before authentication is complete. ^{4 5 6}

The attacker does not need to start with a WordPress login, another CMS login, a stolen cPanel password, or an installed website plugin. The exploit target is the exposed cPanel/WHM service itself. If successful, the attacker can arrive inside a trusted administration layer and then use normal control-panel functions to create or modify accounts, reach hosted files, inspect databases, change site content, add SSH keys, access mail-adjacent assets, or prepare follow-on ransomware. That means investigation should include the cPanel host, hosted websites, customer accounts, databases, mail, SSH keys, backups, and reseller or privileged account activity. ^{3 6 7 11}

This brief does not publish a stable universal IP/domain/hash blocklist for CVE-2026-41940. Forensicators should prove compromise through a local evidence chain: vendor detection-script results, session-file artifacts, cPanel/WHM access logs, privileged administrative actions, hosted-asset changes, and ransomware or malware traces where present. ^{3 4 7}

Observable Hunt Leads

The vendor detection script is the highest-priority local check because it is tailored to session-file indicators for this vulnerability. Run it before deleting session artifacts, and preserve output for IR review. The script looks at session files and access-log context, and cPanel has refined it across multiple advisory updates to reduce false positives. ^{3 4} 08-Jul-2026 · Newly retained (>24h) Unfold Security adds a detection-engineering layer: hunt for exploit-invariant behavior such as suspicious session promotion and authenticated cpsess activity without the normal preceding login path, instead of depending only on static PoC-string matches. Freshness: Newly retained (>24h).²⁸ 20-Jul-2026 · Newly retained (>24h) CrowdSec and KnownHost add older-but-newly-retained operational context: dedicated detection/WAF virtual-patching coverage, reconnaissance telemetry, and provider log-review outcomes should complement, not replace, vendor script output and local access/session correlation. Freshness: Newly retained (>24h).^{34 36}

Many SMBs are not direct cPanel administrators. They may use cPanel indirectly through shared hosting, managed website providers, WordPress hosts, resellers, digital agencies, web developers, or MSP-managed hosting. Scoping should therefore ask both the organization and its providers whether affected cPanel/WHM or WP Squared infrastructure existed, whether it was patched to a fixed build, whether the vendor script was run, and whether hosted assets showed unauthorized access or encryption. The right question is not “was WordPress vulnerable?” or “was the site code vulnerable?” but “was the hosting control panel that manages the web environment vulnerable or compromised?” ^{3 6 7 17 18}

The primary control is to update to a fixed version and restart cPanel services. Vendor-supported mitigations exist for environments that cannot update immediately, including service exposure restrictions and temporary service changes, but Rapid7 and cPanel both frame patching as the preferred long-term fix.^{3 6}

28-Jun-2026 · Newly retained (>24h) Cloudflare's April 30 emergency WAF release adds a source-backed compensating-control check for environments fronted by Cloudflare: confirm the managed rule is active and review logs/blocks, but do not treat WAF coverage as a substitute for updating cPanel & WHM / WP Squared. Freshness: Newly retained (>24h).²³

This card is intentionally reserved for named public victim organizations or companies tied to CVE-2026-41940 exploitation. 26-Jun-2026 · Newly retained (>24h) The June 26 monitor found named public organizations in Ctrl-Alt-Intel reporting, but only as reported targets of public PoC use / attempted exploitation. The retained source set still does not support a validated public list of organizations confirmed compromised by CVE-2026-41940.²¹ 27-Jun-2026 · Newly retained (>24h) The June 27 monitor retained Mr_Rot13 activity-cluster reporting, but it did not add a reliable named public victim organization or company directly tied to confirmed CVE-2026-41940 compromise.²² 28-Jun-2026 · Newly retained (>24h) The June 28 monitor retained Shadowserver report tags and Cloudflare WAF guidance, but found no new reliable named public victim organization or company. Freshness: Newly retained (>24h).^{23 24} 01-Jul-2026 · Newly retained (>24h) The July 1 monitor retained named hosting-provider disclosure evidence from Liquid Web and InMotion Hosting. These sources improve provider/customer-notice scoping, but they do not publish a reliable named end-customer victim list. Freshness: Newly retained (>24h).^{25 26} 03-Jul-2026 · Newly retained (>24h) The July 3 monitor retained ThreatLocker's Sorry ransomware malware-analysis detail, but found no new reliable named victim organization or company. Freshness: Newly retained (>24h).²⁷ 17-Jul-2026 · Newly retained (>24h) The July 17 monitor retained Bluehost as a named hosting-provider customer-notice source. The sources improve VPS/Dedicated, CentOS 6, outage, backup, log-review, and compromise-check scoping, but they do not publish a reliable named end-customer victim list. Freshness: Newly retained (>24h).^{30 31} 19-Jul-2026 · Newly retained (>24h) The July 19 monitor retained InMotion Hosting's direct follow-up and BinaryLane's advisory as named provider/customer-notice sources. These sources strengthen provider-response and unmanaged-VPS scoping, but they do not publish a reliable named end-customer victim list. Freshness: Newly retained (>24h).^{32 33} 20-Jul-2026 · Newly retained (>24h) The July 20 monitor retained KnownHost as an additional named provider/customer-notice source and retained CrowdSec/Beazley Security for telemetry, detection-control, and insurer-adjacent scoping. These sources improve provider-response and evidence-request language, but they do not publish a reliable named end-customer victim list. Freshness: Newly retained (>24h).^{34 35 36} 22-Jul-2026 · Newly retained (>24h) The July 22 monitor retained Coalition Security Labs as insurer/policyholder coordination evidence. It strengthens carrier, broker, and provider-remediation tracking questions, but it does not publish a reliable named end-customer victim list. Freshness: Newly retained (>24h).³⁷ 24-Jul-2026 · Newly retained (>24h) The July 24 monitor retained Socket's GitHub Actions abuse research as a source-backed activity cluster. The source names compromised maintainer/package artifacts and broad workflow-file counts, but it does not publish a reliable named organization/company list confirmed compromised through CVE-2026-41940. Freshness: Newly retained (>24h).³⁸ 27-Jul-2026 · Newly retained (>24h) The July 27 monitor retained ASD's ACSC alert as national-CERT/MSP scoping evidence. ACSC reports active exploitation in Australia and unnamed MSP-managed customer compromise, but it does not name a reliable public victim organization, customer, provider, sector, or actor. Freshness: Newly retained (>24h).³⁹ 29-Jul-2026 · Newly retained (>24h) The July 29 monitor retained Imperva WAF/customer-environment telemetry. Imperva's industry, country, and customer-environment aggregation improves exposure and control scoping, but it does not name a reliable public victim organization or prove successful compromise. Freshness: Newly retained (>24h).⁴⁰ 03-Aug-2026 · Newly retained (>24h) The August 3 monitor retained Government of Guam/BSP as named public victim/disclosure evidence tied to the cPanel-hosted CVE-2026-41940 compromise path. Freshness: Newly retained (>24h) for the May 2 official statement and DysruptionHub profile; Newly retained (publication date not visible) for the BSP restoration notice.^{42 43 44} 09-Aug-2026 · Newly retained; undated The August 9 monitor retained updated Shadowserver current exploit telemetry, but found no additional reliable named public organization or company tied to confirmed CVE-2026-41940 exploitation, ransomware impact, hosted-site compromise, provider notice, or customer notice. Freshness: Newly retained (publication date not visible).⁴¹ 11-Aug-2026 · Newly retained (>24h) The August 11 monitor retained China Daily / CCTV News Client reporting of multiple domestic Sorry ransomware attacks in China, but the source does not name victim organizations or companies. Freshness: Newly retained (>24h).⁴⁵ 13-Aug-2026 · Newly retained (>24h) The August 13 monitor retained DysruptionHub's August 10 Guam/BSP status update: the response remained active, BSP downloads and embedded content were still unavailable while files and datasets were re-uploaded, and no government-wide all-clear, confirmed data theft, ransomware finding, or actor attribution had been published. Freshness: Newly retained (>24h).^{42 43 44} 18-Aug-2026 · Newly retained (>24h) The August 18 monitor retained DysruptionHub's August 16 Guam/BSP presumed-resolved revision: BSP's restoration warning was no longer visible on core BSP pages and reports/data pages were repopulated, but no government-wide all-clear, exact final restoration date, confirmed data theft, ransomware finding, or actor attribution had been published. Freshness: Newly retained (>24h).⁴⁴ 15-Aug-2026 · Newly retained (>24h) The August 15 monitor retained HoneyLabs' July 23 pre-advisory WHM login-path probing analysis, but it did not name a victim organization or prove exploitation. Freshness: Newly retained (>24h).⁴⁶ 25-Aug-2026 · Newly retained; undated The August 25 monitor retained updated HoneyLabs live CVE telemetry, but found no additional reliable named public organization or company tied to confirmed CVE-2026-41940 exploitation, ransomware impact, hosted-site compromise, provider notice, or customer notice beyond the retained Government of Guam/BSP row. Freshness: Newly retained (publication date not visible) for HoneyLabs.⁴⁷

This card tracks source-backed activity associated with CVE-2026-41940 without confusing those activity clusters with named victim organizations. A cluster can be useful for scoping even when public sources do not identify the operator, campaign name, or victim companies.

Public attribution for CVE-2026-41940 is mixed and should stay bounded to the specific source-backed activity being discussed. This card separates named activity clusters from universal attribution claims.

Baseline Retained Sources