CrowdStrike reports fast exploitation of public PoCs, cites cPanel flaw

What happened

CrowdStrike reports that attackers are quickly turning public vulnerability research into attacks. The company says it analyzed in-the-wild exploitation it observed between January and July 2026. It reports that the median time from a public proof of concept (POC) to exploitation was less than one day, and that the fastest case it observed was 35 minutes. It also says that 91 percent of the exploited vulnerabilities with a public POC were exploited within 48 hours of the POC release (CrowdStrike). These figures come only from CrowdStrike’s own observations. They have not been independently verified.

CrowdStrike gives two examples (CrowdStrike):

• cPanel authentication bypass, CVE-2026-41940.
  • According to CrowdStrike, cPanel disclosed the flaw on April 28, 2026. It affects select versions of cPanel, WHM and WordPress Squared (WP2).
  • CrowdStrike says the flaw lets an unauthenticated remote attacker gain unauthorized access to the control panels.
  • CrowdStrike says that on April 29, 2026, an unnamed industry firm published exploitation guidance and a “detection-artifact generator”. CrowdStrike says that tool becomes a working exploit by un-commenting one line that changes the root password.
  • CrowdStrike reports widespread, opportunistic exploitation from April 30, 2026. It says multiple distinct actors often targeted the same servers.
  • CrowdStrike says its retrospective hunting suggests a single actor likely exploited the flaw as a zero-day since at least April 3, 2026. CrowdStrike says how that actor found the flaw remains unknown.
  • One figure caption in the post refers to “August 29, 2026” industry reporting. That date appears inconsistent with the April dates elsewhere in the post and is not confirmed.
  • The source does not state whether cPanel has released a fix or which versions are fixed.
• Linux local privilege escalation “CopyFail”, CVE-2026-31431.
  • CrowdStrike says an industry source released a POC exploit and technical details on April 29, 2026.
  • At that point, according to CrowdStrike, the bug was patched in the Linux mainline but not yet in many major Linux distributions.
  • The available text of the post is truncated, so whether CrowdStrike observed exploitation of CopyFail is not confirmed.

Am I affected?

• CVE-2026-41940: You may be affected if you run cPanel, WHM or WordPress Squared (WP2). CrowdStrike says only “select versions” are affected. Affected versions, fixed versions and the availability of a fix are not confirmed in the source.
• CVE-2026-31431: You may be affected if your Linux distribution’s kernel does not yet include the mainline fix. Affected kernel and distribution versions are not confirmed in the source.

What to do now

1. Check cPanel’s own disclosure for CVE-2026-41940 to find which of your cPanel, WHM and WP2 installations are affected and what remediation cPanel recommends. The source does not describe a fix.
2. CrowdStrike reports a likely zero-day exploitation period from at least April 3, 2026. If you run cPanel servers, review them for unexpected root password changes and unauthorized WHM logins since then (CrowdStrike).
3. Check whether your Linux distribution has shipped a kernel update for CVE-2026-31431, and apply it when available.
4. CrowdStrike says adversaries often adopt public vulnerability research within hours. For software you expose to the internet, track public POC releases as well as vendor advisories (CrowdStrike).

Sources

• CrowdStrike: How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders