cPanel Vulnerability Exploited Against Government MSP Networks | MSSP Advisory

An unknown threat actor exploited the recently disclosed cPanel vulnerability to target government entities in Southeast Asia plus MSPs and hosting providers across Philippines, Laos, Canada, South Africa, and the US. The attack campaign was detected on May 2, 2026, specifically targeting managed service providers alongside military networks. The vulnerability allows attackers to gain unauthorized access to cPanel installations and potentially pivot to hosted client environments.

Your own infrastructure is at risk if you run cPanel for client hosting or internal systems management, giving attackers a direct path into your entire client base through compromised control panels. Client environments using cPanel for web hosting face immediate exposure, and you have a contractual obligation to notify them about this active exploitation targeting MSPs specifically. The threat actor is already hitting MSPs as primary targets, not just opportunistic victims.

📬