Complete Security Toolkit for cPanel servers infected with CVE-2026-41940 / nuclear.x86.
Two scripts — one full audit and one auto cleanup with Imunify360.
Works on both original license and bypass/shared license servers.
👨💻 Author
⚠️ Vulnerability Overview
How to tell if your server is infected:
wget google.com
# "Killed" দেখালে → nuclear.x86 এখনো চলছে
# স্বাভাবিক download হলে → malware নেই বা আগেই মরেছে
| Script | Function | When to use |
|---|
cpanel_security_check.sh | Full server audit, malware kill, SSH key rotation | Run this first |
imunify360_scan_clean.sh | Scan all accounts and cleanup webshells with Imunify360 | Then run this |
⚡ Quick Start — Run both together
cd /root && \
wget -O cpanel_security_check.sh \
https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/cpanel_security_check.sh && \
wget -O imunify360_scan_clean.sh \
https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/imunify360_scan_clean.sh && \
bash cpanel_security_check.sh && \
bash imunify360_scan_clean.sh
⚠️ Make sure to run as root
🔍 Script 1 — cpanel_security_check.sh
Run:
bash <(curl -s https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/cpanel_security_check.sh)
What it checks:
- nuclear.x86 process kill
- SSH key rotation (with backup)
- cPanel update (
/scripts/upcp --force)
🛡️ Script 2 — imunify360_scan_clean.sh
Run:
bash <(curl -s https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/imunify360_scan_clean.sh)
What it does:
Webshell filename patterns it searches for:
wp-cache-*.php wp-check-*.php wp-sync-*.php
wp-util-*.php admin-init-*.php upgrade-*.php
class-wp-*.php task_*.php .*\.php (hidden)
Webshell code patterns:
eval(base64_decode system($_ passthru($_
assert($_ exec($_ shell_exec($_
📋 Requirements
If Imunify360 is not installed, install it:
wget https://repo.imunify360.cloudlinux.com/defence360/imunify-deploy.sh
bash imunify-deploy.sh --key YOUR_LICENSE_KEY
📁 Output Files
/root/cpanel_security_audit_TIMESTAMP.log ← Script 1 log
/root/imunify360_cleanup_TIMESTAMP.log ← Script 2 log
/root/imunify360_report_TIMESTAMP.txt ← Infected files list
/root/webshell_backup/ ← Deleted files backup
🚨 Emergency Manual Commands
Kill malware:
pkill -9 -f "nuclear.x86"
ps auxf | grep nuclear
Block cPanel ports (until patch is applied):
iptables -I INPUT -p tcp --dport 2083 -j DROP
iptables -I INPUT -p tcp --dport 2087 -j DROP
iptables -I INPUT -p tcp --dport 2095 -j DROP
iptables -I INPUT -p tcp --dport 2096 -j DROP
Update cPanel:
Stop cPanel services:
whmapi1 configureservice service=cpsrvd enabled=0 monitored=0 && \
whmapi1 configureservice service=cpdavd enabled=0 monitored=0 && \
/scripts/restartsrv_cpsrvd --stop && \
/scripts/restartsrv_cpdavd --stop
✅ Cleanup Checklist
☐ Run cpanel_security_check.sh
☐ Run imunify360_scan_clean.sh
☐ Reset passwords for all cPanel accounts
☐ Reset all FTP / email / MySQL passwords
☐ Update wp-config.php / .env files
☐ Check for unknown email forwards
☐ Check for unknown cron jobs
☐ Check for unknown FTP accounts
☐ Revoke old SSH keys from GitHub / GitLab
☐ Check for unknown WordPress admin users
☐ Update all WordPress plugins and themes
🖥️ Compatibility
| OS | Status |
|---|
| AlmaLinux 8/9 | ✅ |
| CloudLinux 7/8 | ✅ |
| CentOS 7 | ✅ |
| Rocky Linux 8/9 | ✅ |
| Ubuntu 20/22 (cPanel) |
📚 Reference
📄 License
MIT License — Free to use, share, and modify.
Please keep author attribution intact when sharing.
🆘 Support
⚠️ Share this toolkit with everyone — anyone with a cPanel server can be infected by this vulnerability.
❤️ Support This Project
If this toolkit helped secure your server or saved you time, consider supporting future development and security research.
☕ Donate / Support
🔗 Donation Link:
https://pay.shurjopayment.com/d21kNExwjP
Your support helps with:
- 🔐 Security research & malware analysis
- 🛠️ Maintaining cPanel security scripts
- 🚀 Free community tools for hosting providers
- 📚 Publishing new security advisories & fixes
Every contribution helps keep hosting servers safer. Thank you for supporting the project ❤️
mahfuzreham/cpanel-cve-2026-41940
