Perth Web Hosting

Update on the cPanel Vulnerability (CVE-2026-41940)

Our number 1 priority is to ensure all our servers are secure and client sites are safe. On strong industry advice and as a precaution, Perth Web Hosting has decided to restrict access to cPanel, WHM (resellers), and cPanel webmail.

We understand this can be a minor inconvenience, but this is only for the short term.

The reason why we've taken this approach is that cPanel's first patch didn't fully resolve the exploit. The other reason is that at least two Australian providers have been affected. The National Institute of Standards and Technology has assigned this a 10/10 rating, which is very rare for a software company to receive; hence, we have taken this measure.

We continue to monitor all reports, and our action is to protect everyone. We will lift this block as soon as we can and it is safe to do so.

In the mean time, there is no impact to website or email services. If you need to access your files, you can use Filezilla.

Yesterday, a vulnerability was discovered in the cPanel software around 3:30am 29th April 2026. (CVE-2026-41940).

We were alerted to temporarily block the main cpanel ports until the fix has been patched by cPanel. Note, this issue affected all hosting providers who run their hosting platforms on cPanel - not just us.

By 9am, cPanel released a fix to patch the vulnerability, and we had all our servers patched by 9:45am.

We are continuously monitoring the status of this vulnerability, as this has been marked as extremely serious by the NIST.

cPanel has now released a statement to say the vulnerability has been fixed as long as we're running the latest version of cPanel, which we have triple-checked on all our cPanel servers. We are still monitoring forums as well as the security alert. We will advise if we need to take further action. Thank you

Site information:

Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026 Latest Article Changes:04/29/26 02:46PM CST: Updated article's required actions and added detection script.04/28/26 04:36PM CST: Updated article to include patched versions.04/28/26 03:19PM CST: Up...

We are now officially in the embargo period until 05/01/2026 after a very busy period. This means no more updates, installs or migrations until we return.

Why do we have an embargo period?
To ensure all websites are up during the shutdown period. If we start changing stuff and things break, we don't really want to be working on fixing issues whilst we are on break. After all, we are human, and we all need a reset.

What happens if a site breaks during our shutdown?
Submit a ticket and we'll investigate as soon as we can. Charges may apply.

Would you still be able to look into my issue?
We'll make sure to address all high-priority requests promptly. Please note that charges might apply if the issue isn't caused by us. We're continuously checking our system to ensure everything runs smoothly. For lower-priority issues, we'll do our best to resolve them quickly, though there might be some longer wait times - after all we are not robots.

Phone support
Open until 5:30pm, 23/12/2025. Closed from 24/12/2025 and reopening 5/01/2026.

Emergency Telephone Support
Phone (08) 6102 1966. For all critical requests, only 24/7. Charges will apply if the request is not urgent ($189 exGST per hour.)

Billing
Automatic credit cards will still be functioning as normal. All bank transfers will be checked up to 23/12/2025 then we will not be checking until we return on the 05/01/2026.