# Sorry Ransomware Mass Exploitation of cPanel/WHM Authentication Bypass CVE-2026-41940 (44,000+ Servers Compromised)

> Financially motivated threat actors are mass-exploiting cPanel/WHM authentication bypass CVE-2026-41940 to deploy 'Sorry', a previously undocumented Go-based Linux encryptor that uses ChaCha20 with an embedded RSA-2048 public key and appends the .sorry extension. Shadowserver reports at least 44,000 cPanel IP addresses compromised since the emergency patch released on 2026-04-28. Decryption is impossible without the operator's RSA-2048 private key, hundreds of victim sites are already indexed by Google, and CISA added the underlying CVE to the Known Exploited Vulnerabilities catalog on 2026-04-30.

- **Published:** 2026-05-02T22:15:00Z
- **Last reviewed:** 2026-09-27T02:40:31.037Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0449
- **ID:** TL-2026-0449
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 56 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

OVERVIEW

'Sorry' is an opportunistic, internet-scale ransomware campaign that pivoted off the public disclosure of CVE-2026-41940 — a critical pre-authentication bypass in cPanel and Web Host Manager (WHM) — to monetize approximately 1.5 million internet-exposed cPanel instances. The campaign was first reported by BleepingComputer on 2026-05-02 after Shadowserver telemetry confirmed at least 44,000 unique compromised cPanel IP addresses. Hundreds of victim sites are now indexed in Google search results because the encryptor leaves a public README.md ransom note in the document root of every web account it touches. Decryption is impossible without the operator's RSA-2048 private key (analyst Rivitna), so the only path to recovery is restoration from clean offline backups followed by full server rebuild and patch.

VULNERABILITY CHAIN — CVE-2026-41940

CVE-2026-41940 is a pre-authentication remote authentication bypass in the cPanel session subsystem (cpsrvd). The bug chains three primitives. First, before authentication occurs cpsrvd writes a new session file to disk based on the value of the whostmgrsession cookie. Second, by omitting an expected segment of the cookie an attacker forces cpsrvd to skip the encryption/MAC step, leaving the on-disk session file as plaintext that cpsrvd will accept on subsequent requests. Third, raw CRLF (\r\n) characters can be injected into the session file via a malicious HTTP Authorization: Basic header, allowing the attacker to inject arbitrary key/value properties — most importantly user=root — directly into the session record. On the next authenticated request the attacker presents the now-privileged session cookie and is treated as the root WHM administrator without ever providing valid credentials. The vulnerability affects all cPanel and WHM versions after v11.40 plus the WP Squared v136.1.7 managed-WordPress build that derives from cPanel. Approximately 1.5 million cPanel instances were exposed to the internet on cPanel default ports (2082/2083/2086/2087/2095/2096) at the time of disclosure (Shodan telemetry referenced by Rapid7).

EXPLOITATION TIMELINE

In-the-wild exploitation has been confirmed since 2026-02-23 by hosting provider KnownHost, meaning CVE-2026-41940 was a true zero-day for roughly two months before cPanel released its emergency advisory on 2026-04-28. CISA added it to the KEV catalog on 2026-04-30 with an aggressive remediation deadline. The 'Sorry' ransomware payload was first observed on Thursday 2026-04-30 — within 48 hours of the patch release — strongly suggesting an opportunistic actor who waited for proof-of-concept publication before turning long-running access into ransom revenue.

MALWARE — 'SORRY' LINUX ENCRYPTOR

The payload is a statically linked Go ELF for x86_64 Linux (SHA-256 2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a, distributed via VirusTotal). It implements a textbook hybrid cryptosystem: a per-file ChaCha20 stream-cipher key is generated locally, used to encrypt file contents in place, then itself encrypted with an embedded RSA-2048 public key and prepended (or appended) to the ciphertext. The encrypted file is renamed with a .sorry extension. A README.md ransom note is dropped in every directory the encryptor traverses; the note is identical across all victims and directs them to contact the operator over the Tox messaging protocol via the qTox client, using the Tox ID 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724. There is no relation to the unrelated 2018 HiddenTear-derived 'Sorry' campaign that shared the .sorry extension.

The encryptor is non-destructive in the sense that it does not wipe shadow copies or run pre-encryption discovery typical of double-extortion crews — consistent with a single operator monetizing scale rather than a mature RaaS affiliate program. There is no leak site, no double-extortion staging, and no observed exfiltration tooling on victim hosts. The campaign relies entirely on volume.

IMPACT

Victims are web-hosting customers — small businesses, agencies, e-commerce stores, and personal sites — whose document roots, mail spools, and database dumps live under /home/<user>/ on cPanel servers. Once the operator pivots from WHM-root via the bypass to a shell, every account on the box is encrypted in a single sweep. Because so many victim sites still respond to HTTP and serve the public README.md, Google has crawled and indexed hundreds of ransom notes — turning the breach into reputational damage on top of operational outage. There are no confirmed nation-state TTPs; attribution is currently UNKNOWN with motivation FINANCIAL.

DETECTION AND RESPONSE

Defenders should treat any cPanel/WHM server unpatched on 2026-04-28 as presumed-compromised. Triage steps: (1) verify cpsrvd is on a patched build, (2) audit /var/cpanel/sessions/ and /usr/local/cpanel/logs/ for session files containing user=root that were not created by an interactive admin login, (3) hunt access logs for HTTP requests carrying a whostmgrsession cookie that lacks the encryption segment combined with an Authorization: Basic header containing CRLF, (4) search filesystems for *.sorry files and any README.md in document roots that reference the published Tox ID, and (5) hash-compare any suspicious Go binaries against the published SHA-256. For prevention going forward, restrict cPanel admin ports (2087/2086) to a management VPN and disable WHM access from the public internet.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1505.003 Server Software Component: Web Shell
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1027.002 Obfuscated Files or Information: Software Packing
- T1070.004 Indicator Removal: File Deletion
- T1556 Modify Authentication Process
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1071 Application Layer Protocol
- T1071.001 Application Layer Protocol: Web Protocols
- T1095 Non-Application Layer Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1550 Use Alternate Authentication Material
- T1606 Forge Web Credentials
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1543 Create or Modify System Process
- T1203 Exploitation for Client Execution
- T1087 Account Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1491 Defacement
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1595.002 Active Scanning: Vulnerability Scanning

## Sources

- [Critical cPanel flaw mass-exploited in 'Sorry' ransomware attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/)
- [cPanel zero-day exploited for months before patch release (CVE-2026-41940) — Help Net Security](https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/)
- [CVE-2026-41940 Detail — NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
- [CVE Record: CVE-2026-41940 (MITRE)](https://www.cve.org/CVERecord?id=CVE-2026-41940)
- [ETR: CVE-2026-41940 cPanel & WHM Authentication Bypass — Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/)
- [The Internet Is Falling Down — cPanel & WHM Authentication Bypass CVE-2026-41940 — watchTowr Labs](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/)
- [CVE-2026-41940 Explained: cPanel & WHM Authentication Bypass That Hit 1.5M Servers — Picus Security](https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers)
- [CVE-2026-41940: A Critical Authentication Bypass in cPanel — Hadrian](https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel)
- [CVE-2026-41940: cPanel & WHM Auth Bypass Flaw — SOC Prime](https://socprime.com/blog/cve-2026-41940-critical-cpanel-whm-authentication-bypass-exposes-hosting-servers-to-admin-takeover/)
- [cPanel's authentication bypass bug is being exploited in the wild, CISA warns — CyberScoop](https://cyberscoop.com/cpanel-authentication-bypass-vulnerability-cve-2026-41940-exploited/)
- [SECURITY ALERT: Critical Authentication Bypass in cPanel & WHM (CVE-2026-41940) — Trend Micro](https://success.trendmicro.com/en-US/solution/KA-0023294)
- [Shadowserver Foundation honeypot telemetry — cPanel scanning and exploitation activity](https://www.shadowserver.org/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0449