Penguin Internet experienced a minor incident on April 30, 2026, lasting 2h 58m. The incident has been resolved; the full update timeline is below.
Update timeline
- investigating Apr 30, 2026, 08:46 AM UTC
cPanel have today released details of a zero day cPanel vulnerability that allows authentication bypass to servers and hosting accounts. We are in the process of deploying emergency updates to all servers to patch this, therefore some services may be briefly affected whilst the updates are applied. Please note, cPanel and WHM access is blocked until the updates are complete https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
- resolved Apr 30, 2026, 11:44 AM UTC
We can confirm that all servers have been patched against this vulnerability. We have also undertaken a detailed security audit of all servers to identify any activity that may have been linked to this. Thankfully, due to our security hardening in place on our servers, the automated attacks were not able to do any damage to servers or accounts. We will continue to investigate this in the background and are adding further security measures to prevent any future such issues.