Nearly a week after the makers of cPanel and WHM warned users about a critical flaw, hackers are exploiting this vulnerability on thousands of servers. As of Monday, over 550,000 potentially vulnerable servers were identified by Shadowserver, with around 2,000 likely compromised.

Security researchers reported that Google had indexed dozens of websites displaying ransom notes from the perpetrators, indicating a significant portion of these servers may have been turned into unwitting participants in a ransomware scheme. Some sites, however, now load normally, suggesting the extent of the damage is not yet clear.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog on Thursday, urging government agencies to patch their servers by Sunday. CISA did not respond when asked if government agencies had complied.

According to Daniel Pearson, CEO of KnownHost, his company detected attacks as early as February 23rd. Despite cPanel’s acknowledgment of the request for comment, no official response was provided.