Scan for compromised cPanel/WHM session files.
CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026
Detection Script
Run this as the following:
bash <(curl -Ls https://de.webdade.com/Script/cPanel-CVE-2026-41940/ioc_checksessions_files.sh)
This will generate a summary similar to the following example:
=================================================================
SCAN SUMMARY
=================================================================
CRITICAL findings: 1
WARNING findings: 0
ATTEMPT findings: 1
INFO findings: 0
Total : 2
-----------------------------------------------------------------
=================================================================
SESSION: /var/cpanel/sessions/raw/:cusK9ghEd6MPo4eW
=================================================================
Findings:
[ATTEMPT ] Failed exploit attempt (badpass origin, token_denied, no auth markers, anomalous pass= line)
=================================================================
SESSION: /var/cpanel/sessions/raw/:TMnjH0tBK6jP2V3I
=================================================================
Findings:
[CRITICAL] Exploitation artifact - token_denied with injected cp_security_token (badpass origin, token used)
[!] INDICATORS OF COMPROMISE DETECTED - IMMEDIATE ACTION REQUIRED
1. Purge all affected sessions
2. Force password reset for root and all WHM users
3. Audit /var/log/wtmp and WHM access logs for unauthorized access
4. Check for persistence mechanisms (cron, SSH keys, backdoors)