cpanel-cve-2026-41940-fix

One-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and patching.

This repo contains a single Bash script that:

• Detects whether your server is vulnerable (cPanel build check)
• Detects whether your server is already compromised (11 IOC checks)
• Remediates safely — kills malware, blocks C2 IPs, purges forged sessions, restarts cpsrvd
• Patches cPanel/WHM via /scripts/upcp --force
• Generates a forensics report and preserves evidence

It is designed for hosting providers, sysadmins, and cPanel resellers who need to triage a fleet quickly.

⚠️ Before you run anything

If wget or curl return Killed when you try to download things, the malware is still running — nuclear.x86 actively kills download tools to prevent cleanup. Run the kill-step first (the script does this for you in --fix mode).

If you can't download this script because of that, copy-paste it via SSH from your laptop, or use scp.

Installation

Or with curl:

One-liner (review the script first, then run):

Verify before running. This script runs as root and modifies system state. Open it and read it first. Do not pipe random scripts from the internet directly into bash.

Usage

Three modes

Exit codes

Output locations

• Log: /var/log/cpanel-cve-fix/scan-<TIMESTAMP>.log
• Report: /var/log/cpanel-cve-fix/report-<TIMESTAMP>.txt
• Evidence backup: /root/cve-cleanup-backup-<TIMESTAMP>/

What it checks (scan phase)

What it does (fix / auto phase)

• Kills known malware processes (after snapshotting PID, cmdline, exe path)
• Blocks known C2 IPs in CSF if present, otherwise iptables (and persists rules)
• Purges /var/cpanel/sessions/raw/* (with tar.gz backup first)
• Restarts cpsrvd, cpdavd, cphulkd, queueprocd, dnsadmin
• Patches cPanel via /scripts/upcp --force (only in --auto)
• Clears package-manager caches, BIND DNS cache (rndc flush), old journal logs
• Hardens by enabling CSF LF_INTEGRITY if available

What it deliberately does NOT do

These would do more harm than good when run unattended over SSH, so they go in the manual-action report instead:

• ❌ Rotate SSH keys (would lock you out of the very box you're running it on)
• ❌ Rotate cPanel / MySQL / email passwords (script can't update all the dependent configs)
• ❌ Restore data from backup (only you know your last-known-good restore point)
• ❌ Delete arbitrary files in /home/*/public_html
• ❌ Mass-delete cron entries

Fleet usage

For sweeping many servers from a jump-box:

Then grep the reports:

Manual actions you must still take after running the script

The script will list these in its report. None of them can be safely automated.

1. Rotate every local Linux password (the attacker has /etc/shadow)
2. Rotate cPanel + reseller passwords from WHM
3. Rotate every MySQL/database password and update wp-config.php, .env, config.php, etc.
4. Rotate every email account password
5. Rotate every API token (cPanel, WHM, third-party)
6. Regenerate SSH keys for root and any IT user — and remove the old public key from GitHub / GitLab / Bitbucket / CI / deployment targets
7. Audit /home/*/public_html for web-shells (recently modified .php files)
8. Audit cPanel email forwarders / FTP accounts / cron jobs for backdoors
9. Restore data from a backup taken before the first IOC timestamp (industry-wide that's around 23 Feb 2026)
10. Tell affected customers to rotate their cPanel password everywhere else they reused it

Patched cPanel / WHM versions

You need to be at or above one of these builds:

Check yours with /usr/local/cpanel/cpanel -V.

Indicators of compromise (IOCs)

FAQ

Is it safe to run on a healthy server? Yes. Default mode is scan-only and makes no changes. The fix and auto modes are idempotent.

Will it cause downtime? --fix causes a brief WHM/cPanel interruption when it restarts cpsrvd (~10 seconds). --auto runs /scripts/upcp --force which can take 10–30 minutes — websites stay up during this, but WHM is briefly unavailable at the end.

My cPanel version isn't in the patched list — am I safe? If you're on a track older than 110.0.x, you're on an end-of-life version. cPanel will not ship a patch. Treat the host as compromised until proven otherwise and upgrade urgently.

The script says Killed when it tries to do anything. That's nuclear.x86 actively killing your tools. Run the kill step manually first:

Then re-run the script.

Does this work on AlmaLinux / Rocky / CloudLinux / CentOS? Yes — all standard cPanel platforms. Tested on AlmaLinux 8, Rocky 9, CloudLinux 7+.

Will it touch my customer websites? No. The script does not modify anything in /home/*/public_html. It only touches OS-level config, cPanel sessions, firewall rules, and known-bad processes.

Contributing

PRs welcome — particularly for:

• Additional IOCs (new C2 IPs, new malware names) seen in the wild
• OS-specific hardening tweaks
• Translations of the report output

Please don't add anything that auto-rotates credentials or deletes user data — keeping the destructive surface narrow is intentional.

License

MIT. Use it, fork it, integrate it into your own tooling. Attribution appreciated but not required.

Credits

Built by WHMCSPilot.com — SM.

Vulnerability research credit: cPanel security team, watchTowr Labs, Rapid7, KnownHost, and the broader hosting community who shared IOCs as the campaign unfolded.

Disclaimer

This script is provided as-is, without warranty. It is a first-response triage tool — not a substitute for a full incident-response engagement. If you handle PII, payment data, or other regulated data, consult your DPO and a qualified IR firm before declaring a compromised box clean.

If a server has been actively compromised, the safest path is always to rebuild from a known-good backup, not to clean in place.