The Vuln_WHMs List Contains Exactly 180 Vulnerable Server Logins

HEROIC analysts identified a file named Vuln_WHMs uploaded to a Telegram channel in July 2026. WHM, or WebHost Manager, is server administration software used to manage entire hosting servers, often controlling many websites, email accounts, and cPanel logins underneath it. The file contains exactly 180 records pairing email addresses with plaintext passwords and the URLs those login panels sit behind. Why This Is Dangerous: A WHM login is not access to one website, it is access to the server that hosts many websites at once. Someone with a working WHM credential can potentially control every site, email account, and database on that server. Because the passwords in this file are plaintext, an attacker can try each one immediately with no cracking required. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the WHM login panels Why This Matters: Even 180 working WHM logins represent a serious risk, since compromising a single server admin account can hand an attacker control over dozens of individual websites and their visitors' data at once. That kind of access is commonly used to install malware, redirect traffic, harvest additional credentials, or launch further attacks from a trusted server, causing damage that reaches far beyond the original account holder. How a Combolist Like This Works: This type of list is built by scanning for WHM login panels exposed on the internet and testing known or leaked passwords against them, keeping only the credentials that actually worked, hence the vuln label marking them as confirmed vulnerable. Attackers trade or sell these verified lists on Telegram because working server-level access is far more valuable than an unverified guess. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address appears in this leak or any other. If you manage a WHM or hosting server, change your admin password immediately, restrict panel access by IP address where possible, and check your server logs for unauthorized logins.