Sorry Ransomware Mass Exploitation of cPanel/WHM Authentication Bypass CVE-2026-41940 (44,000+ Servers Compromised)

Sorry Ransomware Mass Exploitation of cPanel/WHM (TL-2026-0449), also tracked as Sorry Ransomware, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-05-02 and last reviewed 2026-08-23. It has no confirmed attribution, affects cPanel, L.L.C. cPanel, references 1 CVE (CVE-2026-41940), maps to 50 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 39 indicators of compromise.

Key facts for TL-2026-0449

Threat ID
TL-2026-0449
Also known as
Sorry Ransomware, .sorry encryptor, Sorry Linux Encryptor
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
2026-05-02
Last reviewed
2026-08-23
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
hosting, small-business, ecommerce, media, agencies, personal-sites, wordpress-hosting, managed-services
Target regions
Global, North America, Europe, Asia, Latin America
Detection rules
9
Indicators of compromise
39
Updates
2026-08-23 · 2 updates · revalidated 2× · latest source

Malware and tooling in Sorry Ransomware Mass Exploitation of cPanel/WHM

Malware and tooling: Sorry HT, Sorry Linux Encryptor, Tox:3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724, qTox

Financially motivated threat actors are mass-exploiting cPanel/WHM authentication bypass CVE-2026-41940 to deploy 'Sorry', a previously undocumented Go-based Linux encryptor that uses ChaCha20 with an embedded RSA-2048 public key and appends the .sorry extension. Shadowserver reports at least 44,000 cPanel IP addresses compromised since the emergency patch released on 2026-04-28. Decryption is impossible without the operator's RSA-2048 private key, hundreds of victim sites are already indexed by Google, and CISA added the underlying CVE to the Known Exploited Vulnerabilities catalog on 2026-04-30.

How Sorry Ransomware Mass Exploitation of cPanel/WHM works

OVERVIEW

'Sorry' is an opportunistic, internet-scale ransomware campaign that pivoted off the public disclosure of CVE-2026-41940 — a critical pre-authentication bypass in cPanel and Web Host Manager (WHM) — to monetize approximately 1.5 million internet-exposed cPanel instances. The campaign was first reported by BleepingComputer on 2026-05-02 after Shadowserver telemetry confirmed at least 44,000 unique compromised cPanel IP addresses. Hundreds of victim sites are now indexed in Google search results because the encryptor leaves a public README.md ransom note in the document root of every web account it touches. Decryption is impossible without the operator's RSA-2048 private key (analyst Rivitna), so the only path to recovery is restoration from clean offline backups followed by full server rebuild and patch.

VULNERABILITY CHAIN — CVE-2026-41940

CVE-2026-41940 is a pre-authentication remote authentication bypass in the cPanel session subsystem (cpsrvd). The bug chains three primitives. First, before authentication occurs cpsrvd writes a new session file to disk based on the value of the whostmgrsession cookie. Second, by omitting an expected segment of the cookie an attacker forces cpsrvd to skip the encryption/MAC step, leaving the on-disk session file as plaintext that cpsrvd will accept on subsequent requests. Third, raw CRLF (\r ) characters can be injected into the session file via a malicious HTTP Authorization: Basic header, allowing the attacker to inject arbitrary key/value properties — most importantly user=root — directly into the session record. On the next authenticated request the attacker presents the now-privileged session cookie and is treated as the root WHM administrator without ever providing valid credentials. The vulnerability affects all cPanel and WHM versions after v11.40 plus the WP Squared v136.1.7 managed-WordPress build that derives from cPanel. Approximately 1.5 million cPanel instances were exposed to the internet on cPanel default ports (2082/2083/2086/2087/2095/2096) at the time of disclosure (Shodan telemetry referenced by Rapid7).

EXPLOITATION TIMELINE

In-the-wild exploitation has been confirmed since 2026-02-23 by hosting provider KnownHost, meaning CVE-2026-41940 was a true zero-day for roughly two months before cPanel released its emergency advisory on 2026-04-28. CISA added it to the KEV catalog on 2026-04-30 with an aggressive remediation deadline. The 'Sorry' ransomware payload was first observed on Thursday 2026-04-30 — within 48 hours of the patch release — strongly suggesting an opportunistic actor who waited for proof-of-concept publication before turning long-running access into ransom revenue.

MALWARE — 'SORRY' LINUX ENCRYPTOR

The payload is a statically linked Go ELF for x86_64 Linux (SHA-256 2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a, distributed via VirusTotal). It implements a textbook hybrid cryptosystem: a per-file ChaCha20 stream-cipher key is generated locally, used to encrypt file contents in place, then itself encrypted with an embedded RSA-2048 public key and prepended (or appended) to the ciphertext. The encrypted file is renamed with a .sorry extension. A README.md ransom note is dropped in every directory the encryptor traverses; the note is identical across all victims and directs them to contact the operator over the Tox messaging protocol via the qTox client, using the Tox ID 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724. There is no relation to the unrelated 2018 HiddenTear-derived 'Sorry' campaign that shared the .sorry extension.

The encryptor is non-destructive in the sense that it does not wipe shadow copies or run pre-encryption discovery typical of double-extortion crews — consistent with a single operator monetizing scale rather than a mature RaaS affiliate program. There is no leak site, no double-extortion staging, and no observed exfiltration tooling on victim hosts. The campaign relies entirely on volume.

IMPACT

Victims are web-hosting customers — small businesses, agencies, e-commerce stores, and personal sites — whose document roots, mail spools, and database dumps live under /home/<user>/ on cPanel servers. Once the operator pivots from WHM-root via the bypass to a shell, every account on the box is encrypted in a single sweep. Because so many victim sites still respond to HTTP and serve the public README.md, Google has crawled and indexed hundreds of ransom notes — turning the breach into reputational damage on top of operational outage. There are no confirmed nation-state TTPs; attribution is currently UNKNOWN with motivation FINANCIAL.

DETECTION AND RESPONSE

Defenders should treat any cPanel/WHM server unpatched on 2026-04-28 as presumed-compromised. Triage steps: (1) verify cpsrvd is on a patched build, (2) audit /var/cpanel/sessions/ and /usr/local/cpanel/logs/ for session files containing user=root that were not created by an interactive admin login, (3) hunt access logs for HTTP requests carrying a whostmgrsession cookie that lacks the encryption segment combined with an Authorization: Basic header containing CRLF, (4) search filesystems for *.sorry files and any README.md in document roots that reference the published Tox ID, and (5) hash-compare any suspicious Go binaries against the published SHA-256. For prevention going forward, restrict cPanel admin ports (2087/2086) to a management VPN and disable WHM access from the public internet.

MITRE ATT&CK techniques used in TL-2026-0449

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1074 Data Staged

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1070.002 Indicator Removal: Clear Linux or Mac System Logs; T1070.004 Indicator Removal: File Deletion

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

Persistence

T1053.003 Scheduled Task/Job: Cron; T1098 Account Manipulation; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell; T1543 Create or Modify System Process

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1078.003 Valid Accounts: Local Accounts; T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1491 Defacement; T1657 Financial Theft

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files; T1606 Forge Web Credentials; T1606.001 Forge Web Credentials: Web Cookies

lateral-movement

T1550 Use Alternate Authentication Material

defense-impairment

T1556 Modify Authentication Process

Resource Development

T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1587 Develop Capabilities

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Sorry Ransomware Mass Exploitation of cPanel/WHM

  • cPanel, L.L.C. — cPanel
    Vulnerable versions: all versions after v11.40 prior to 2026-04-28 patch
    Fixed in: STABLE/RELEASE/CURRENT/EDGE builds released 2026-04-28 and later
  • cPanel, L.L.C. — WHM (Web Host Manager)
    Vulnerable versions: all versions after v11.40 prior to 2026-04-28 patch
    Fixed in: STABLE/RELEASE/CURRENT/EDGE builds released 2026-04-28 and later
  • WP Squared — WP Squared (managed WordPress on cPanel)
    Vulnerable versions: v136.1.7
    Fixed in: vendor-issued build post-2026-04-28

Remediation for Sorry Ransomware Mass Exploitation of cPanel/WHM

Patches

  • cPanel & WHM emergency security advisory of 2026-04-28 — apply latest STABLE/RELEASE/CURRENT/EDGE tier build
  • WP Squared customers must update past v136.1.7 to the vendor-issued fixed build
  • Patch all cPanel installations newer than v11.40 — every supported tier is affected

Immediate actions

  • Apply cPanel/WHM emergency patch released 2026-04-28 to all affected servers immediately
  • Restrict WHM admin ports 2086/2087 and cPanel ports 2082/2083 to a management VPN; remove from public internet exposure
  • Audit /var/cpanel/sessions/ for session files containing user=root not tied to a known admin login and revoke all active WHM sessions
  • Block the Tox ID 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724 in DLP and review outbound Tox/UDP traffic
  • Hunt all webroots for *.sorry files and README.md ransom notes; isolate any host returning matches

Workarounds

  • If patching cannot be completed within the CISA KEV deadline, place WHM behind a reverse proxy that strips raw CRLF from Authorization headers and rejects whostmgrsession cookies with a missing encryption segment
  • Temporarily disable WHM root login over the public internet and route through SSH-only management
  • Rate-limit and geo-fence cPanel admin ports at the perimeter until patch verification is complete

Longer-term hardening

  • Deploy host-based EDR with Linux kernel telemetry on all hosting infrastructure to detect Go-compiled ELF execution and high-volume rename/write activity
  • Implement immutable, off-host backups with tested restore procedures for every cPanel account
  • Adopt least-privilege segmentation between customer accounts so a single WHM compromise does not encrypt every tenant
  • Subscribe to CISA KEV alerts and require patch SLAs of <72h for KEV-listed vulnerabilities affecting internet-exposed services
  • Add file-integrity monitoring on cpsrvd binaries and /var/cpanel/sessions/ to catch future session-tampering primitives

CVEs associated with Sorry Ransomware Mass Exploitation of cPanel/WHM

CVE-2026-41940

Weaknesses (CWE) in Sorry Ransomware Mass Exploitation of cPanel/WHM

CWE-287, CWE-93, CWE-384, CWE-345, CWE-306

Timeline of Sorry Ransomware Mass Exploitation of cPanel/WHM

  • Hosting provider KnownHost confirms first observed in-the-wild exploitation of CVE-2026-41940 against cPanel/WHM honeypots and customer fleet — true zero-day exploitation begins.
  • CVE-2026-41940 reportedly disclosed to cPanel by external researchers approximately two weeks before the public advisory; cPanel begins emergency patch development.
  • cPanel internally confirms the authentication-bypass vulnerability (10:47 CDT) after receiving an external report, and begins emergency patch development.
  • cPanel publishes emergency security advisory and ships out-of-band patches across STABLE/RELEASE/CURRENT/EDGE tiers; patch is available within hours of advisory.
  • watchTowr Labs (researcher Sina Kheirkhah) publishes a technical writeup reconstructing CVE-2026-41940 from a diff of cPanel's silent patch and releases a public GitHub detection-artifact generator PoC.
  • Rapid7, watchTowr Labs, Picus Security, Hadrian, and SOC Prime publish technical write-ups detailing the cpsrvd session-cache CRLF injection chain; proof-of-concept tradecraft is now public.
  • Mass deployment of the 'Sorry' Linux encryptor begins on Thursday 2026-04-30 — within 48 hours of the patch release — across servers that remained unpatched after the public advisory.
  • CISA adds CVE-2026-41940 to the Known Exploited Vulnerabilities catalog and issues a remediation deadline for federal civilian agencies.
  • cPanel refines its official CVE-2026-41940 compromise-detection script to eliminate false positives reported by partners and users running it against production hosts.
  • Hosting providers KnownHost, Namecheap, HostPapa, and InMotion preemptively firewall inbound TCP/2083 and TCP/2087 to protect unpatched customers.
  • Shadowserver Foundation reports 44,000 unique cPanel IPs scanning, brute-forcing, or exploiting CVE-2026-41940 against its honeypot sensors and ~650,000 cPanel/WHM instances exposed to the internet.
  • Ctrl-Alt-Intel reports a separate campaign exploiting CVE-2026-41940 against Philippine and Laotian government/military domains and MSPs across the Philippines, Laos, Canada, South Africa, and the US (with an Indonesian defense training portal and a Chinese railway-sector exfiltration target also implicated), deploying AdaptixC2, OpenVPN, and Ligolo.
  • BleepingComputer publishes the first public report of the 'Sorry' ransomware campaign; analyst Rivitna confirms hybrid ChaCha20+RSA-2048 cryptosystem makes decryption impossible without the operator key. Hundreds of victim sites already indexed by Google due to publicly served README.md ransom notes.
  • The count of actively compromised or scanning IPs tied to the campaign drops to roughly 3,540, per reporting on the Ctrl-Alt-Intel findings.
  • webhosting.today publishes analysis confirming CVE-2026-41940 was actively exploited for 64 days prior to public disclosure and patch.
  • Independent researchers report roughly 40,000+ cPanel servers compromised and encrypted with the Sorry ransomware since disclosure, including 194 of 1,692 publicly exposed servers in Japan alone.
  • Security Affairs reports a separate Go-based 'Payload' infector using the same auth bypass to install SSH keys, PHP webshells, and the cross-platform 'Filemanager' remote-access backdoor, attributed to threat actor 'Mr_Rot13'; C2 download server identified at cp.dene.de.com with exfiltration via Telegram bots.
  • Bitdefender publishes its May 2026 Threat Debrief confirming CVE-2026-41940 is being actively exploited in ransomware campaigns that grant attackers privileged server control, and surfacing the separate APAC espionage cluster.
  • As of 2026-05-29, this remains ACTIVE: CVE-2026-41940 (CVSS 9.8, CISA KEV) is patched but still mass-exploited, with Censys seeing 7,135+ cPanel hosts bearing .sorry artifacts and 2,000+ attacker IPs in May 2026. Multiple actors weaponize it (Sorry ransomware, Mirai, Filemanager backdoor); no decryptor, takedown, or arrests reported.

Update history for TL-2026-0449

Sources cited for Sorry Ransomware Mass Exploitation of cPanel/WHM

Threats related to Sorry Ransomware Mass Exploitation of cPanel/WHM

Detection coverage for TL-2026-0449

As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0449 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats