https://vulnerability.circl.lu/sightings/feed 2026-09-20T10:31:03.049957+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3f8e3d1b-c9b2-4005-8c86-476f6063b1e8/export 2026-09-20T10:31:03.057027+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3f8e3d1b-c9b2-4005-8c86-476f6063b1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-19)", "content": "", "creation_timestamp": "2026-09-20T10:15:06.644930Z"} 2026-09-20T10:15:06.644930+00:00 https://vulnerability.circl.lu/sighting/2b205fce-292a-4bdb-a4af-3e81dd3bc982/export 2026-09-20T10:31:03.059667+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2b205fce-292a-4bdb-a4af-3e81dd3bc982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-19)", "content": "", "creation_timestamp": "2026-09-20T10:00:03.642721Z"} 2026-09-20T10:00:03.642721+00:00 https://vulnerability.circl.lu/sighting/fb7c0ae6-1f31-4f0c-84cd-70adb96700d2/export 2026-09-20T10:31:03.059757+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fb7c0ae6-1f31-4f0c-84cd-70adb96700d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-18)", "content": "", "creation_timestamp": "2026-09-19T10:15:07.056513Z"} 2026-09-19T10:15:07.056513+00:00 https://vulnerability.circl.lu/sighting/29a3fa67-6c24-4f9c-9e52-2a7934e60a15/export 2026-09-20T10:31:03.059822+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "29a3fa67-6c24-4f9c-9e52-2a7934e60a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-18)", "content": "", "creation_timestamp": "2026-09-19T10:00:05.918427Z"} 2026-09-19T10:00:05.918427+00:00 https://vulnerability.circl.lu/sighting/0073eab4-299a-4407-8d43-f2445041c776/export 2026-09-20T10:31:03.059880+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0073eab4-299a-4407-8d43-f2445041c776", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42427", "content": "cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor\n\nA threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments.\nThe attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager (WHM) that could result in an authentication bypass and allow remote attackers to gain elevated control of the control\nhttps://thehackernews.com/2026/05/cpanel-cve-2026-41940-under-active.html", "creation_timestamp": "2026-09-19T00:00:44.753785Z"} 2026-09-19T00:00:44.753785+00:00 https://vulnerability.circl.lu/sighting/1fe0f1ce-21b6-47e3-81ed-912725e5809c/export 2026-09-20T10:31:03.059943+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1fe0f1ce-21b6-47e3-81ed-912725e5809c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42282", "content": "Critrical cPanel flaw mass-exploited in \"Sorry\" ransomware attacks\n\nA new disclosed cPanel flaw tracked as CVE-2026-41940 is being mass-exploited to breach websites and encrypt data in \"Sorry\" ransomware attacks. [...]\nhttps://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/", "creation_timestamp": "2026-09-19T00:00:40.868398Z"} 2026-09-19T00:00:40.868398+00:00 https://vulnerability.circl.lu/sighting/57eb9a05-944b-44e5-9197-6b2a0aa2b429/export 2026-09-20T10:31:03.060009+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "57eb9a05-944b-44e5-9197-6b2a0aa2b429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42289", "content": "The cPanel Situation Is Spiraling Fast\n\nOn April 29, CVE-2026-41940 was disclosed: a critical pre-authentication bypass in cPanel/WHM that lets remote attackers skip the login flow entirely and gain elevated access. Within 24 hours, it was already being weaponized. Censys watched the fallout in real time.\nhttps://darkwebinformer.com/the-cpanel-situation-is-spiraling-fast/", "creation_timestamp": "2026-09-19T00:00:40.802442Z"} 2026-09-19T00:00:40.802442+00:00 https://vulnerability.circl.lu/sighting/ba1456e4-f9bd-4101-bc18-386256cf0206/export 2026-09-20T10:31:03.060072+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ba1456e4-f9bd-4101-bc18-386256cf0206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42310", "content": "Over 40,000 Servers Compromised in Ongoing cPanel Exploitation\n\nThe attacks likely target CVE-2026-41940, a recently patched zero-day leading to administrative access.\nThe post Over 40,000 Servers Compromised in Ongoing cPanel Exploitation appeared first on SecurityWeek.\nhttps://www.securityweek.com/over-40000-servers-compromised-in-ongoing-cpanel-exploitation/", "creation_timestamp": "2026-09-19T00:00:40.679462Z"} 2026-09-19T00:00:40.679462+00:00 https://vulnerability.circl.lu/sighting/9e56647d-3364-4ff5-993d-abfef714533a/export 2026-09-20T10:31:03.060131+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9e56647d-3364-4ff5-993d-abfef714533a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42239", "content": "Critical cPanel and WHM bug exploited as a zero-day, PoC now available\n\nThe critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since late February. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-cpanel-and-whm-bug-exploited-as-a-zero-day-poc-now-available/", "creation_timestamp": "2026-09-19T00:00:39.181257Z"} 2026-09-19T00:00:39.181257+00:00 https://vulnerability.circl.lu/sighting/c427d8f5-e3a5-4ccf-bd38-db54c3701660/export 2026-09-20T10:31:03.060189+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c427d8f5-e3a5-4ccf-bd38-db54c3701660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41940", "type": "published-proof-of-concept", "source": "Telegram/c5SreYmrDkdJR1r3a8RFt1SI3OPNA8AQ129hesIQxK_5L6E", "content": "", "creation_timestamp": "2026-09-19T00:00:25.063683Z"} 2026-09-19T00:00:25.063683+00:00