Security alert: CVE-2026-41940 in cPanel / WHM allows administrative access and mass ransomware

A critical authentication failure in cPanel / WHM, recorded as CVE-2026-41940, is being exploited in mass and has already been linked to ransomware campaigns aimed at Linux servers hosting websites. Vulnerability allows attackers to avoid control panel access controls and obtain administrative privileges over cPanel / WHM-managed sites, post and databases; therefore the emergency update published in late April is a priority for any hosting administrator. The official notification and update can be found on the cPanel portal: security update of cPanel.

Community telemetry records and reports show that the exploitation is not theoretical: it was used as a zeroday since at least the end of February and, according to Shadowserver, tens of thousands of PIs with cPanel have been compromised in this initial wave ( Shadowserver report). The attackers are deploying a Go-written cipher called "Sorry," focused on Linux environments and that modifies file extensions, leaving a folder rescue notice.

From the technical point of view, the reported malicious code uses ChaCha20 to encrypt the content and protect the key with an integrated RSA.-2048 public key, which implies that data recovery without the private key is practically impossible unless valid backup is available or the private key of the attacker is recovered. A binary sampling has been uploaded to analysis platforms such as VirusTotal, which facilitates detection for response equipment: sample example in VirusTotal.

If you administer cPanel / WHM, immediate action should be to update the servers to the parched version provided by cPanel before any other mitigation task, because vulnerability allows direct administrative access. After patching, they isolate the compromised servers from the network, preserve evidence of log and process and do not restart critical machines without coordinating it with the forensic team, as volatility can remove important traces to determine the point of entry and the scope of the attack.

For detection and containment, check the systems for indicators: encrypted files with the extension '. Sorry' (reports suggest that the extension can be added repeatedly), presence of README.md notes with contact instructions, abnormal running processes, chronab entries or new scheduled tasks and webshells in public directories. Complete with integrity scans on web files and databases, account analysis with privileges, SSH key changes and immediate rotation of exposed credentials. Do not pay the ransom as the first option; contact the authorities and their legal and security team to assess options, and consider that the only reliable way to restore is from validated backups.

At the preventive and resistance level, host providers and administrators must strengthen access policies: limit access to administrative ports only to allowed IP addresses, enable multifactor authentication wherever possible, review and tighten firewall and WAF rules, and apply network segmentation so that a committed panel does not result in the total loss of other machines. It is also critical to validate that backups are offline or inaccessible to the user running the panel, and to practice regular restorations to ensure the integrity of backups.

For intermediary response teams and affected customers, plan transparent communication: inform customers and stakeholders about the scope and actions in progress, documenting which data may have been exposed and what measures are being taken. Organizations with large attack surfaces should consider a search sweep of IOCs at the supplier level and coordinate with intelligence teams on threats to block commands and domains associated with the campaign.

This campaign shows how a vulnerability in a central management component can quickly scale to loss of widespread data. The operational lesson is to prioritize security updates in infrastructure tools, maintain segregated backup and automate the detection of changes in productive environments. He hopes that exploitation will increase in the next few days and weeks: acting quickly and in a manner reduces the likelihood of becoming the next victim.