Hackers Breach Government and Military Servers by Exploiting cPanel Vulnerability

Cybersecuritynews •Guru Baran • May 2, 2026

A sophisticated adversarial campaign targeting South-East Asian government and military infrastructure, combining rapid exploitation of a critical cPanel authentication bypass with a custom zero-day exploit chain against an Indonesian defense-sector portal and ultimately pivoting to exfiltrate over 4GB of sensitive Chinese railway documents. The campaign’s initial access vector centered on CVE-2026-41940, a critical CVSS 9.8 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical cPanel Vulnerability Exploited in Southeast Asia Cyber Attacks A sophisticated cyber campaign has exploited a critical cPanel vulnerability (CVE-2026-41940) to breach government and military servers in Southeast Asia, particularly targeting Indonesia. The attackers utilized a custom zero-day exploit chain to access sensitive information, exfiltrating over 4GB of documents related to Chinese railway projects. The vulnerability was published on April 29, 2026, and was actively exploited as of April 30, 2026. In addition to Indonesian targets, the campaign has also affected managed service providers (MSPs) in countries including the Philippines, Laos, Canada, and the U.S. The attack highlights the urgent need for organizations to patch this critical vulnerability to prevent further exploitation. Current assessments indicate that the threat remains active and evolving. 2 sources 78

Extracted Entities

Hackers Breach Government and Military Servers by Exploiting cPanel Vulnerability

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (1)

Industries (1)

MITRE ATT&CK (2)

Platforms (1)