🔒 cPanel CVE-2026-41940 — Complete Security Toolkit

Complete Security Toolkit for cPanel servers infected with CVE-2026-41940 / nuclear.x86. Two scripts — one full audit and one auto cleanup with Imunify360. Works on both original license and bypass/shared license servers.

---

👨‍💻 Author

Name	MD Mahfuz Reham
Role	System Admin | Web Hosting Specialist
Website	MahfuzReham.Com
WhatsApp	+8801790614055
GitHub	github.com/mahfuzreham

---

⚠️ Vulnerability Overview

Detail	Info
CVE ID	CVE-2026-41940
CVSS Score	9.8 — Critical
Affected	All supported cPanel & WHM versions
Exploit	Actively exploited before public disclosure
Malware	nuclear.x86 Linux botnet
Attacker IPs	87.121.84.78 · 45.148.120.23

How to tell if your server is infected:

wget google.com
# "Killed" দেখালে → nuclear.x86 এখনো চলছে
# স্বাভাবিক download হলে → malware নেই বা আগেই মরেছে

---

📦 What's in this Toolkit

Script	Function	When to use
cpanel_security_check.sh	Full server audit, malware kill, SSH key rotation	Run this first
imunify360_scan_clean.sh	Scan all accounts and cleanup webshells with Imunify360	Then run this

---

⚡ Quick Start — Run both together

cd /root && \
wget -O cpanel_security_check.sh \
  https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/cpanel_security_check.sh && \
wget -O imunify360_scan_clean.sh \
  https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/imunify360_scan_clean.sh && \
bash cpanel_security_check.sh && \
bash imunify360_scan_clean.sh

⚠️ Make sure to run as root

---

🔍 Script 1 — cpanel_security_check.sh

Run:

bash <(curl -s https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/cpanel_security_check.sh)

What it checks:

Check	Description
🦠 Malware process	Detect and kill active nuclear.x86 process
🌐 wget/curl test	Confirms if malware is active
🔌 Attacker IPs	Checks if there is a connection to C2 IPs
📜 History scan	Searches shell history for attack signatures
📦 cPanel version	Check last update and patch status
🔓 Port exposure	Check if 2083, 2087, 2095, 2096 are open
🗝️ SSH keys	Audit private key age and authorized_keys
⏰ Cron jobs	Scan for suspicious cron entries
🐚 Webshells	Scan public_html for PHP shells
🔐 SUID binaries	Detect unexpected SUID files

Auto cleanup performs:

• nuclear.x86 process kill
• SSH key rotation (with backup)
• cPanel update (/scripts/upcp --force)

---

🛡️ Script 2 — imunify360_scan_clean.sh

Run:

bash <(curl -s https://raw.githubusercontent.com/mahfuzreham/cpanel-cve-2026-41940/main/imunify360_scan_clean.sh)

What it does:

Step	Action
1	Check Imunify360 status and service
2	Update malware signature database
3	Full scan of all cPanel accounts
4	Scan for CVE-2026-41940 webshell patterns
5	Auto cleanup + quarantine
6	Delete suspicious files (with backup)
7	Enable real-time protection
8	Setup daily auto-scan cron
9	Full summary report

Webshell filename patterns it searches for:

wp-cache-*.php    wp-check-*.php    wp-sync-*.php
wp-util-*.php     admin-init-*.php  upgrade-*.php
class-wp-*.php    task_*.php        .*\.php (hidden)

Webshell code patterns:

eval(base64_decode    system($_     passthru($_
assert($_             exec($_        shell_exec($_

---

📋 Requirements

	cpanel_security_check.sh	imunify360_scan_clean.sh
OS	CentOS / AlmaLinux / CloudLinux / Ubuntu	CentOS / AlmaLinux / CloudLinux / Ubuntu
Panel	cPanel & WHM	cPanel & WHM
Access	Root SSH	Root SSH
Software	—	Imunify360 (licensed)

If Imunify360 is not installed, install it:

wget https://repo.imunify360.cloudlinux.com/defence360/imunify-deploy.sh
bash imunify-deploy.sh --key YOUR_LICENSE_KEY

---

📁 Output Files

/root/cpanel_security_audit_TIMESTAMP.log     ← Script 1 log
/root/imunify360_cleanup_TIMESTAMP.log        ← Script 2 log
/root/imunify360_report_TIMESTAMP.txt         ← Infected files list
/root/webshell_backup/                        ← Deleted files backup

---

🚨 Emergency Manual Commands

Kill malware:

pkill -9 -f "nuclear.x86"
ps auxf | grep nuclear

Block cPanel ports (until patch is applied):

iptables -I INPUT -p tcp --dport 2083 -j DROP
iptables -I INPUT -p tcp --dport 2087 -j DROP
iptables -I INPUT -p tcp --dport 2095 -j DROP
iptables -I INPUT -p tcp --dport 2096 -j DROP

Update cPanel:

/scripts/upcp --force

Stop cPanel services:

whmapi1 configureservice service=cpsrvd enabled=0 monitored=0 && \
whmapi1 configureservice service=cpdavd enabled=0 monitored=0 && \
/scripts/restartsrv_cpsrvd --stop && \
/scripts/restartsrv_cpdavd --stop

---

✅ Cleanup Checklist

☐ Run cpanel_security_check.sh
☐ Run imunify360_scan_clean.sh
☐ Reset passwords for all cPanel accounts
☐ Reset all FTP / email / MySQL passwords
☐ Update wp-config.php / .env files
☐ Check for unknown email forwards
☐ Check for unknown cron jobs
☐ Check for unknown FTP accounts
☐ Revoke old SSH keys from GitHub / GitLab
☐ Check for unknown WordPress admin users
☐ Update all WordPress plugins and themes

---

🖥️ Compatibility

OS	Status
AlmaLinux 8/9	✅
CloudLinux 7/8	✅
CentOS 7	✅
Rocky Linux 8/9	✅
Ubuntu 20/22 (cPanel)	✅

---

📚 Reference

• cPanel Security Advisory — CVE-2026-41940

---

📄 License

MIT License — Free to use, share, and modify. Please keep author attribution intact when sharing.

---

🆘 Support

• 🌐 MahfuzReham.Com
• 💬 WhatsApp: +8801790614055
• 🐙 GitHub: github.com/mahfuzreham

---

⚠️ Share this toolkit with everyone — anyone with a cPanel server can be infected by this vulnerability.

❤️ Support This Project

If this toolkit helped secure your server or saved you time, consider supporting future development and security research.

☕ Donate / Support

🔗 Donation Link: https://pay.shurjopayment.com/d21kNExwjP

Your support helps with:

• 🔐 Security research & malware analysis
• 🛠️ Maintaining cPanel security scripts
• 🚀 Free community tools for hosting providers
• 📚 Publishing new security advisories & fixes

Every contribution helps keep hosting servers safer. Thank you for supporting the project ❤️