cpanel-cve-2026-41940-fix

One-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940 and the nuclear.x86 botnet campaign.

---

What this is

On 28 April 2026, cPanel disclosed a pre-authentication authentication-bypass vulnerability (CVE-2026-41940, CVSS 9.8) affecting all supported cPanel & WHM versions after 11.40. A single HTTP request to port 2087 lets an unauthenticated attacker inject a user=root session and walk straight into WHM.

Exploitation has been seen in the wild since at least 23 February 2026 — six weeks before the patch dropped. The campaign we've cleaned up on multiple servers drops a Linux botnet called nuclear.x86 along with an XMRig-based crypto-miner.

This repo contains a single Bash script that:

• Detects whether your server is vulnerable (cPanel build check)
• Detects whether your server is already compromised (11 IOC checks)
• Remediates safely — kills malware, blocks C2 IPs, purges forged sessions, restarts cpsrvd
• Patches cPanel/WHM via /scripts/upcp --force
• Generates a forensics report and preserves evidence

It is designed for hosting providers, sysadmins, and cPanel resellers who need to triage a fleet quickly.

---

⚠️ Before you run anything

If wget or curl return Killed when you try to download things, the malware is still running — nuclear.x86 actively kills download tools to prevent cleanup. Run the kill-step first (the script does this for you in --fix mode).

If you can't download this script because of that, copy-paste it via SSH from your laptop, or use scp.

---

Installation

# As root, on the cPanel server:
cd /root
wget https://raw.githubusercontent.com/shahidmallaofficial/cpanel-cve-2026-41940-fix/main/fix-cpanel-cve-2026-41940.sh
chmod +x fix-cpanel-cve-2026-41940.sh

Or with curl:

cd /root
curl -fsSLO https://raw.githubusercontent.com/shahidmallaofficial/cpanel-cve-2026-41940-fix/main/fix-cpanel-cve-2026-41940.sh
chmod +x fix-cpanel-cve-2026-41940.sh

One-liner (review the script first, then run):

cd /root && \
curl -fsSLO https://raw.githubusercontent.com/shahidmallaofficial/cpanel-cve-2026-41940-fix/main/fix-cpanel-cve-2026-41940.sh && \
chmod +x fix-cpanel-cve-2026-41940.sh && \
less fix-cpanel-cve-2026-41940.sh
# After reviewing, run it:
./fix-cpanel-cve-2026-41940.sh

Verify before running. This script runs as root and modifies system state. Open it and read it first. Do not pipe random scripts from the internet directly into bash.

---

Usage

Three modes

# 1. Scan only (default, no changes — always safe to run)
./fix-cpanel-cve-2026-41940.sh

# 2. Scan + remediate, with a confirmation prompt for each destructive action
./fix-cpanel-cve-2026-41940.sh --fix

# 3. Full auto: fix + cPanel update + cache clear + light hardening
./fix-cpanel-cve-2026-41940.sh --auto

# 4. Unattended (no prompts — for cron, jump-boxes, fleet scripts)
./fix-cpanel-cve-2026-41940.sh --auto -y

# 5. Help
./fix-cpanel-cve-2026-41940.sh --help

Exit codes

Code	Meaning
0	Clean — no IOCs detected
2	Compromise indicators detected (review the report)
1 / other	Pre-flight failure (not root, not a cPanel server, etc.)

Output locations

• Log: /var/log/cpanel-cve-fix/scan-<TIMESTAMP>.log
• Report: /var/log/cpanel-cve-fix/report-<TIMESTAMP>.txt
• Evidence backup: /root/cve-cleanup-backup-<TIMESTAMP>/

---

What it checks (scan phase)

#	Check	What it catches
1	cPanel build vs patched releases	Vulnerable hosts (lists all 6 patched builds)
2	Running processes	nuclear.x86, xmrig, cpuminer, minerd, xmr-stak, 4thepool_miner
3	Active network connections	The three known C2 IPs + mining-pool ports
4	Shell history files	IOC commands in bash_history / zsh_history
5	Firewall sanity	The iptables -F sabotage step
6	cPanel session raw dir	Forged user=root session files
7	/tmp, /var/tmp, /dev/shm	Recently dropped executables
8	Cron entries	Persistence (system + per-user)
9	authorized_keys files	New SSH keys — read-only audit
10	cPanel access logs	Go-http-client / python-requests exploit signatures
11	Critical binaries	Tampered wget / curl / ls / ps (mtime + RPM verify)

What it does (fix / auto phase)

• Kills known malware processes (after snapshotting PID, cmdline, exe path)
• Blocks known C2 IPs in CSF if present, otherwise iptables (and persists rules)
• Purges /var/cpanel/sessions/raw/* (with tar.gz backup first)
• Restarts cpsrvd, cpdavd, cphulkd, queueprocd, dnsadmin
• Patches cPanel via /scripts/upcp --force (only in --auto)
• Clears package-manager caches, BIND DNS cache (rndc flush), old journal logs
• Hardens by enabling CSF LF_INTEGRITY if available

What it deliberately does NOT do

These would do more harm than good when run unattended over SSH, so they go in the manual-action report instead:

• ❌ Rotate SSH keys (would lock you out of the very box you're running it on)
• ❌ Rotate cPanel / MySQL / email passwords (script can't update all the dependent configs)
• ❌ Restore data from backup (only you know your last-known-good restore point)
• ❌ Delete arbitrary files in /home/*/public_html
• ❌ Mass-delete cron entries

---

Fleet usage

For sweeping many servers from a jump-box:

mkdir -p reports
while read -r host; do
    echo "=== $host ==="
    scp fix-cpanel-cve-2026-41940.sh "root@${host}:/root/" >/dev/null
    ssh "root@${host}" '/root/fix-cpanel-cve-2026-41940.sh --auto -y'
    scp "root@${host}:/var/log/cpanel-cve-fix/report-*.txt" "reports/${host}.txt" 2>/dev/null
done < servers.txt

Then grep the reports:

grep -l "COMPROMISE INDICATORS PRESENT" reports/*

---

Manual actions you must still take after running the script

The script will list these in its report. None of them can be safely automated.

1. Rotate every local Linux password (the attacker has /etc/shadow)
2. Rotate cPanel + reseller passwords from WHM
3. Rotate every MySQL/database password and update wp-config.php, .env, config.php, etc.
4. Rotate every email account password
5. Rotate every API token (cPanel, WHM, third-party)
6. Regenerate SSH keys for root and any IT user — and remove the old public key from GitHub / GitLab / Bitbucket / CI / deployment targets
7. Audit /home/*/public_html for web-shells (recently modified .php files)
8. Audit cPanel email forwarders / FTP accounts / cron jobs for backdoors
9. Restore data from a backup taken before the first IOC timestamp (industry-wide that's around 23 Feb 2026)
10. Tell affected customers to rotate their cPanel password everywhere else they reused it

---

Patched cPanel / WHM versions

You need to be at or above one of these builds:

Track	Patched build
110.0.x	11.110.0.97
118.0.x	11.118.0.63
126.0.x	11.126.0.54
132.0.x	11.132.0.29
134.0.x	11.134.0.20
136.0.x	11.136.0.5
WP²	11.136.1.7

Check yours with /usr/local/cpanel/cpanel -V.

---

Indicators of compromise (IOCs)