US CISA flags critical cPanel/WHM and Linux CopyFail bugs actively exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued urgent alerts about two separate vulnerabilities that are being actively exploited. The first, tracked as CVE‑2026‑41940, affects WebPros cPanel & WHM and the WP2 WordPress tool. It allows unauthenticated remote attackers to bypass login checks and obtain administrative control over hosting control panels, exposing thousands of websites to compromise. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a remediation deadline of May 3 2026, urging federal agencies and private operators to apply patches or discontinue the affected products.

The second alert concerns the CopyFail bug in major Linux kernel versions, which CISA says is currently being used in hacking campaigns targeting servers and datacenters. The agency warns that exploitation could disrupt critical infrastructure that relies on Linux. In both cases, CISA recommends immediate patching, adherence to Binding Operational Directive 22‑01 for cloud services, and removal of vulnerable software where mitigation is not possible.