Your website can be perfect and still be broken into — through your web host.

The bit of your website you've never seen

Your website is a set of files and a database sitting on a computer in a data centre. You don't own that computer — your web host does. If you pay someone a monthly fee so your site stays online, that's your host, whether it's a big international brand, a local Australian provider, or the web designer who "looks after everything".

On most of those computers there's a piece of software called a control panel — the dashboard your host (or you) uses to create email accounts, set up databases, install certificates and manage files. The most widely used one in the world is called cPanel, along with its administrator counterpart WHM. You may never have logged into it. It's still there, and it has complete authority over your site.

That matters because of a simple asymmetry: you can do everything right on your website and still lose it, if the layer beneath it is broken into. Your plugins can be current, your passwords long, your policies immaculate — none of it helps if an attacker walks in one level below.

What happened in April, and why it isn't over

In April 2026, a critical flaw was disclosed in cPanel and WHM, formally tracked as CVE-2026-41940. It is an authentication bypass — plain English: a way to get in without a password. It scores 9.8 out of 10 on the standard severity scale, close to the maximum, because it requires no login, no user error and no interaction from anyone. It affects every version after 11.40, which was released back in 2013 — so essentially every unpatched installation. Patches were released on 30 April 2026.

The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) issued an advisory stating it was aware of active exploitation in Australia. The line in that advisory that should matter most to a small business is this one: the ACSC noted that products managed by several Managed Service Providers were impacted, resulting in the compromise of their customers. Not "customers who were careless". Customers.

The scale was not small. The Shadowserver Foundation, which runs sensors across the internet, reported roughly 44,000 unique IP addresses scanning or attempting exploitation against its honeypots on 30 April 2026 — a spike that fell away over the following days as patches landed. Security researchers reported successful exploitation may date back to February 2026, months before the fix existed.

And it did not end in April. In July 2026, researchers documented a campaign that hijacked GitHub Actions — a free service developers use to run automated tasks — to spin up thousands of throwaway machines whose only job was to scan the internet for cPanel and WHM servers still vulnerable to CVE-2026-41940. Three months after a fix was available, attackers were confident enough that plenty of servers remained unpatched to build an industrial-scale hunting operation around it. On the evidence, they were right.

Worth saying clearly: plenty of hosts handled this well. Several major providers — Namecheap, HostGator and KnownHost among them — temporarily blocked access to their cPanel interfaces while they patched. Briefly locking customers out of a dashboard to close a hole is exactly the behaviour you want from a host. The question isn't whether hosts get bad news; it's what they do in the following 48 hours.

Why it matters to your business, not just your website

If the machine your site lives on is compromised, three things follow, and none of them are theoretical.

Your customers' data is on that machine. Names, email addresses, phone numbers, order history, appointment records, enquiry-form submissions — whatever your site collects lives in a database on that same server. If a business covered by the Privacy Act suffers a data breach that's likely to result in serious harm, the Notifiable Data Breaches scheme requires it to notify the OAIC and the affected individuals, generally after an assessment completed within 30 days. That obligation doesn't pause because the failure happened at your host rather than in your office. Whether it applies to your business specifically depends on your circumstances, and is worth having a professional confirm.

Your site becomes the attack. A compromised server is typically used to plant a hidden file that gives permanent access, inject card-skimming code into a checkout, redirect your visitors to a scam, or send spam under your domain name. Your customers experience all of that as you.

It costs real money. The ASD's Annual Cyber Threat Report 2024–25 put the average self-reported cost of cybercrime for a small business at $56,600 per report — up 14% on the year before. That's the average across all cybercrime reports, not a hosting-specific figure, but it's the right order of magnitude for what a serious incident does to a small operation.

The awkward part: you can't fix this one yourself

This is what makes the hosting layer different from every other item on a website security checklist. If you're on shared hosting — the common, inexpensive arrangement where many websites share one server — you have no ability to patch the control panel. You couldn't if you wanted to. That's the host's job, and it's most of what you're paying them for.

Which means the useful action isn't technical. It's asking. And the answer you get, and how quickly you get it, tells you a great deal about whether the monthly fee is buying you anything beyond disk space.

Five questions to email your host this week

What you can check from the outside

You can't see your host's patch level from the internet. But some of the consequences of a poorly-run hosting setup are visible from outside, without logging into anything — and they're a reasonable proxy for how carefully the underlying server has been configured.

None of these prove your host has been compromised. What they indicate is how much care went into the setup — and a server where nobody switched off directory listing is not a server where somebody is watching for critical patches.

Where a scan fits in

Being precise about what we can and can't see: AegorIQ cannot tell you whether your web host has patched its control panel. Nobody outside your host can. That answer only comes from asking them, which is why the email above is the substantive action in this guide.

What our Expert report does check, from the outside and without logging into anything, is the four visible signals in the table above — exposed service ports, directory listing, exposed backup and config files, and exposed non-production subdomains — along with your TLS/encryption configuration. Every tier, including the free Scorecard, also checks your site's software against a live vulnerability feed, which covers the layer you can control. The full, itemised list of what we do and don't check is published here, including the limits.

The honest summary of this week: run the outside check if it's useful to you, but send the email either way. It costs two minutes and it's the only way to get the answer that actually matters.