Guam cyber incident disrupts government websites

Analyst assessment

DysruptionHub’s published report documented that multiple Government of Guam websites were disrupted during a widespread cyber incident affecting cPanel-hosted systems. The Guam Homeland Security and Office of Civil Defense announcement said the territorial government activated its cyber incident response on May 2, 2026, while investigating exploitation of a critical zero-day vulnerability affecting cPanel and WebHost Manager.

The vendor later identified the flaw as CVE-2026-41940, a critical authentication vulnerability in the cPanel & WHM session-management layer. cPanel said a specially crafted request could cause an unauthenticated session to be treated as authenticated, granting access without valid credentials. DysruptionHub assesses with high confidence that successful exploitation of this vulnerability compromised internet-facing web-hosting infrastructure used by Government of Guam agencies.

Operational significance

The incident affected public access to government information and online administrative materials. The Bureau of Statistics and Plans said its website experienced service disruption, requiring residents to use Google Drive, email and in-person alternatives to review planning documents and submit public comments. This created a direct workaround burden for residents and agency staff even though emergency operations were reported as available.

The impact persisted beyond the initial outage. BSP’s current website notice says most file downloads and embedded content could not be restored from the compromised site and that staff are securely re-uploading files, datasets, reports and media. The confirmed data effect is unavailability of public materials; the reviewed sources do not establish whether information was copied or exposed.

Disclosure posture

The Government of Guam publicly acknowledged the incident, linked it to a globally exploited cPanel vulnerability and activated a coordinated response. Agency notices then documented practical service effects and alternative access methods. These disclosures provide organization-confirmed evidence for both the cyber event and the resulting disruption.

The public record does not identify which attacker exploited the vulnerability, whether all affected websites shared a server or hosting provider, or whether unauthorized access extended beyond website infrastructure. Government statements also did not confirm that personal information, credentials, email, databases or internal networks were accessed.

Current status

The incident remains active. On August 2, BSP’s official site still said the agency was restoring its website and securely re-uploading files, datasets and media that could not be restored from the compromised site. No later government-wide all-clear or completed restoration notice was found.

Confidence and uncertainty

Confidence is high in vulnerability exploitation because the territorial government directly connected its response to the cPanel zero-day and cPanel’s vendor analysis identifies the affected vulnerability and access condition. Confidence is also high that public website services, downloads and access to online records were disrupted.

Ransomware remains unresolved. The Government of Guam said encryption and ransomware-type activity were among worst-case scenarios under review, and broader exploitation of CVE-2026-41940 included ransomware activity elsewhere. The reviewed Guam sources do not confirm encryption, a ransom note, payment demand, leak threat or data-theft extortion. No named actor has been publicly attributed.

Analytic gaps

The reviewed sources do not establish the complete affected-agency list, hosting architecture, initial exploitation time, attacker identity, persistence mechanism, affected accounts, accessed databases, email impact or whether credentials were compromised. They also do not quantify the unavailable or unrecoverable files, establish whether information was copied or exposed, or provide a final government-wide restoration date.