CVE-2026-41940 Detection script finds possibly injected session files with no sign of usage
Hello,
The detection script shows the indicators of compromise detected text when it ends, and by analyzing the output it prints as it runs, all I see are many rows like this:
[!] CRITICAL: Multi-line pass value detected: /var/cpanel/sessions/raw/.......
Found possible injected session file: /var/cpanel/sessions/raw/.......
- No sign of usage
Since it says no sign of usage was the server compromised? Please advise.
Thank you.
-
If it says "no sign of usage" that indicates the system was not compromised. You should still manually remove those session files from the system.
1 -
cPRex We just saw the following added to the news article by Devon.
https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
05/01/26 08:05AM CST: Temporarily removed the current detection script while we confirm a new version
Can you confirm that indeed something has gone wrong with the script or is it just to clarify the meaning off entries to avoid confusion?0 -
This is just to avoid confusion - it sounds like the updated script will get released soon.
1 -
The new script has been released we just ran it on the test server I mentioned in the other post I can confirm that we no longer have any false positives showing up. We will run the script on the other servers and downscale our alert level accordingly if nothing is found.
Edit:
Confirmed no false positives on all infrastructure with the new script on our side.
veronicabend
Your report mirrored ours hopefully you get the same result as well.
cPRex
I suggest cPanel sends out a mail and inform customers they have to rerun the script.
Please say thanks to Devon from us for the fast response and of course to you and everyone else involved with resolving the situation.0 -
Can someone please confirm whether the bypass check server uses Python?
We are using ModSecurity to block any Python requests to our servers, and in our logs there are far too many blocked requests since this issue appeared.
From what I can see, our servers are completely fine. The servers where we did not have this ModSecurity rule in place were compromised. Once we added the rule, no further issues occurred.0 -
I am a newbie on cPanel with a little experience.
Can someone please expain the steps to use the script.
I assume I copy the given script to a file using Notepad ++ and save with file name:
ioc_checksessions_files.sh
Then I upload the file to a specific directory? Which one? ( I have Configserver Explorer on my server to do this)
Then I assume I run the script in WHM - Terminal, and view the output? I assume I run the command:
/bin/bash ./ioc_checksessions_files.sh
It would be really helpful for folks like me if cPanel would put the script on the server during the cPanel daily update and provide basic instructions on using the script.
Thank you very much for any help you can provide.
0 -
Hi Bidi, can you please let us know the rule you have created for ModSecurity to block any Python requests? Thank you
0 -
SJR
Hello, just upload to the server for example in /root and then ssh your server : cd /root and run command /bin/bash ./ioc_checksessions_files.sh
Or just cd / after nano ioc_checksessions_files.sh , paste the code and run the command
0 -
Hy cpanzy, i use this since 2020
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile /etc/apache2/conf.d/modsec/badbots.txt" "id:350001,phase:1,deny,status:406,log,msg:'BAD BOT - Detectat. '"
And on the file we got list bots we block like:
CyotekWebCopy
CyotekHTTP
Madfox
python...
0 -
Bidi
Big thank you for your help!
=================================================================
SCAN SUMMARY
=================================================================
CRITICAL findings: 0
WARNING findings: 0
ATTEMPT findings: 81
INFO findings: 0
Total : 81
-----------------------------------------------------------------All 81 "Failed exploit attempt".
Big sigh of relief.
0
Please sign in to leave a comment.
Comments
10 comments