Before You Log In to cPanel: A CVSS 9.8 Flaw Has Let Ransomware Into 1.5 Million Servers

Key Takeaway

• 🔑 CVSS 9.8: The cPanel vulnerability (CVE-2026-41940) carries a critical CVSS score of 9.8 and requires zero credentials to exploit — any unauthenticated attacker can gain root access to a cPanel server.
• ⚠️ 1.5 Million Exposed: Approximately 1.5 million internet-facing cPanel and WHM instances were vulnerable, according to Shodan telemetry referenced by Rapid7.
• 🤖 Sorry Ransomware: A new ransomware group called “Sorry” weaponized the cPanel vulnerability within 48 hours of disclosure, deploying a Go-based Linux encryptor that appends the “.sorry” extension and demands payment via Tox.
• 🕵️ Nation-State Espionage: Ctrl-Alt-Intel identified a separate campaign using CVE-2026-41940 for cyber espionage against government and military entities in Southeast Asia, including the Philippines.
• 🛡️ Patch Now: If your cPanel server was internet-exposed between February and May 2026, treat it as compromised. Update via /scripts/upcp –force, rotate all credentials, and audit the session directory for indicators of compromise.

A critical cPanel vulnerability tracked as CVE-2026-41940 has let ransomware groups, botnet operators, and suspected nation-state actors walk into 1.5 million internet-exposed servers without a single password. The flaw, which carries a CVSS score of 9.8, existed in cPanel and WHM versions dating back to 2014 — making it one of the most far-reaching authentication bypass vulnerabilities since the Fortinet authentication flaw disclosed earlier in August — and was exploited in the wild for roughly two months before cPanel issued an emergency patch on April 28, 2026. The “Sorry” ransomware group weaponized the vulnerability within 48 hours of disclosure, encrypting Linux servers and demanding cryptocurrency ransoms, while a separate espionage campaign targeted government and military entities across Southeast Asia, including the Philippines.

The cPanel vulnerability is not a single coding mistake. It is a chain of four security failures that, when combined, allow an unauthenticated HTTP request to grant full root access. According to Picus Security, which published a detailed technical analysis, the exploit chains a CRLF injection in the session writer with an encryption-skip triggered by a malformed cookie, then exploits a two-file session model to promote injected data into privileged login credentials. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities (KEV) catalog shortly after disclosure, joining other critical flaws like the three CVSS 10.0 flaws in Adobe ColdFusion that demanded immediate patching.

What cPanel and WHM Actually Run

cPanel is the per-account user interface for web hosting; WHM (Web Host Manager) is the root-level admin panel used by hosting providers. Both are served by a Perl daemon called cpsrvd on ports 2082, 2083, 2086, and 2087, with webmail accessible on ports 2095 and 2096. All three components — cPanel, WHM, and WP Squared — were impacted by the cPanel vulnerability. When an attacker compromises WHM, they effectively compromise the entire host, and on shared hosting, every website that host serves.

The scale of exposure is staggering. According to Help Net Security, internet scanner Censys identified 8,859 hosts exposing open directories with filenames ending in “.sorry,” with 7,135 of those confirmed as running cPanel or WHM — strong evidence of large-scale automated exploitation. The Shadowserver Foundation detected over 44,000 unique cPanel-related IPs scanning, running exploits, or engaging in brute force attacks against their honeypot sensors in a single day.

How the cPanel Vulnerability Works — Four Layers of Failure

The technical analysis from Picus Security and ThreatLocker reveals that CVE-2026-41940 is a textbook example of how multiple minor weaknesses combine into a critical vulnerability. The exploit chain has four conceptual steps:

Step 1: Capturing a Pre-Auth Session

When a login is attempted with nonexistent credentials, cPanel creates a pre-auth session file on the server to track the failed attempt. This is standard web server behavior — but it gives the attacker a session file on disk that they can later poison.

Step 2: CRLF Injection via Malformed Cookie

The attacker sends a Basic-auth request with newline-laced credentials (carriage return and line feed characters encoded in base64) using a cookie that deliberately omits the encryption-key segment. The original cPanel code had a sanitizer for these characters, but it was the caller’s responsibility to invoke it — and the Basic-auth handler in cpsrvd did not. Worse, if the encryption key was missing from the cookie, the session writer skipped encryption entirely instead of refusing the operation. The attacker’s payload lands on disk in plaintext and unsanitized.

Step 3: Promoting the Injection Through Cache Re-Parsing

Sessions exist in two places on a cPanel server: a line-oriented raw file and a JSON cache. The loader reads the JSON cache first, where the injected newlines look like harmless escape sequences inside one string. But a separate code path — the “token denied” handler — re-parses the raw file and overwrites the JSON cache, promoting the injected lines into top-level fields that the loader trusts. Values like “hasroot=1,” “tfa_verified=1,” and “user=root” are now treated as legitimate session attributes.

Step 4: Authentication Bypass via Planted Flag

The final insult: cPanel’s password check short-circuits to “AUTH OK” if the session contains a “successful_internal_auth_with_timestamp” value. This field exists for legitimate single-sign-on flows, but its mere presence — with no cryptographic binding — is treated as proof of prior authentication. Because the attacker can now plant arbitrary fields, they plant that field too. From step 4 onward, full WHM API access trivially yields root remote code execution through legitimate WHM features like custom hooks, package management, and PHP-FPM configuration.

Sorry Ransomware: A Deep Dive Into the Encryption Engine

The “Sorry” ransomware group emerged within 48 hours of CVE-2026-41940’s disclosure, exploiting vulnerable cPanel versions between 11.42 (released March 2014) and the patched versions released May 1, 2026. According to ThreatLocker’s threat intelligence team, the Sorry encryptor is written in Golang and targets Linux operating systems, making it distribution-agnostic to ensure encryption success on compromised web servers.

The encryption process uses three layers. First, a session-specific RSA key pair is generated for each victim. Target file contents are encrypted using AES-GCM, and the 32-byte AES key is encrypted with the public RSA key and written to the encrypted file’s header. Finally, the session RSA private key is encrypted using an embedded public key held by the attackers and written to the artifact “sorry_id_.sorry.” Without the attackers’ private key, recovery is impossible — the RSA private key, which decrypts the AES keys, which decrypt the files, is locked behind a key the attackers control.

Before encryption begins, the ransomware terminates critical services including MySQL, Oracle, PostgreSQL, MariaDB, MongoDB, Redis, Cassandra, Elasticsearch, and SSH daemons using systemctl and pkill commands. This ensures database files are not locked during encryption. The encryptor then walks target directories starting from the host root “/”, prioritizing documents and databases before moving to broader file types including applications, media, virtual hard disks, scripts, source code, and development secrets.

SSH Propagation: How Sorry Spreads Beyond the First Server

One of the most dangerous features of the Sorry ransomware is its lateral movement capability. The encryptor attempts to spread through all available SSH connections and mapped external IP addresses using four levels of target discovery. Level 0 targets hosts from known_hosts files and /etc/hosts — the only level that can add external addresses, potentially allowing the ransomware to escape the local network entirely. Level 1 expands active local subnets, while levels 2 and 3 perform /24 and /16 network expansions from discovered IPv4 prefixes.

This propagation strategy means a single compromised cPanel server can become patient zero for an entire hosting infrastructure. If the initial server has SSH connections to other servers in its known_hosts file, the ransomware will attempt to encrypt those machines as well, using the same SSH credentials stored on the compromised host. The ransomware also communicates victim information — including username, hostname, CPU count, OS string, and network interfaces — to attacker infrastructure at IP 68.183.190.253 via TCP, giving the attackers a complete inventory of every machine they have compromised.

Beyond Ransomware: The Mirai Botnet Campaign

The cPanel vulnerability did not just attract ransomware operators. Indian web hosting provider HostMyCode documented a separate, parallel campaign deploying Mirai botnet variants after gaining access through CVE-2026-41940. The specific variant, nuclear.x86, targeted vulnerable cPanel installations to create new administrative accounts, disable security logging, modify firewall rules for persistence, and drop cryptocurrency miners and DDoS bot clients on compromised servers.

“Successful compromises often lead to attacks on customer websites,” HostMyCode warned. “They also target email systems and database servers hosted on the same infrastructure.” Based on scan data, Censys confirmed this campaign is ongoing. For hosting providers, the Mirai campaign represents a different kind of threat — rather than encrypting data for ransom, it silently enslaves servers into a botnet that can be used for distributed denial-of-service attacks, cryptocurrency mining, and as a launching pad for attacks against other targets.

Nation-State Targeting: The Philippines in the Crosshairs

Perhaps the most concerning exploitation of the cPanel vulnerability was identified by Ctrl-Alt-Intel threat researchers, who discovered a cyber espionage campaign leveraging CVE-2026-41940 for intelligence operations. On May 2, 2026, the researchers identified an exposed attacker staging server that provided direct visibility into the operation. From this infrastructure, an unknown threat actor was interactively targeting government and military entities in Southeast Asia, alongside MSPs and hosting providers in the Philippines, Laos, Canada, South Africa, and the United States.

The actor relied heavily on public proof-of-concept code for CVE-2026-41940. The exposed staging server also contained evidence of a separate custom exploit chain targeting an Indonesian defense-sector training portal, alongside earlier exfiltration of Chinese railway-sector data. Ctrl-Alt-Intel stopped short of firm attribution but noted that the combination of victimology, post-compromise pivoting, and the nature of the exfiltrated data makes this activity far more significant than routine opportunistic exploitation.

For Filipino IT professionals and government agencies, the inclusion of the Philippines in the targeting list is a direct warning. Any cPanel server that was internet-exposed and unpatched during the February-to-May 2026 exploitation window should be treated as potentially compromised — not hypothetically, but as a real possibility that a nation-state actor may have already established persistence on the system.

Detection: How to Check if Your Server Was Compromised

cPanel published a vendor detection script that performs filesystem-based triage, though the initial version produced significant false positives and has since been updated. Anyone who ran the script at initial disclosure should run it again with the updated version. Beyond the vendor script, defensive teams should check the session directory for specific indicators of compromise:

Administrators should also audit WHM for unexpected user accounts, SSH keys, cron jobs, and packages that were not present before the exposure window. If any indicators of compromise are found, Linux server management provider Nocinit recommends rebuilding from clean backups as the safest path — stolen credentials, planted SSH keys, hidden cron jobs, leftover API tokens, and sudoers backdoors are all common persistence mechanisms used after a CVE-2026-41940 compromise.

Patched Versions and Mitigation Checklist

If your cPanel server is running any version below the patched releases listed below, it is vulnerable to CVE-2026-41940. Servers with auto-update disabled or version pinning will not patch themselves — they require manual intervention.

The mitigation checklist from Picus Security is straightforward but must be followed in order:

1. Patch: Update via /scripts/upcp –force. Confirm with /usr/local/cpanel/cpanel -V. Restart cpsrvd.
2. Manually patch pinned servers: Servers with auto-update disabled will not heal themselves.
3. Rotate credentials: Force-reset root and every WHM reseller password. Rotate API tokens. Re-issue SSH keys stored in WHM-managed accounts.
4. Purge sessions: Clear /var/cpanel/sessions/raw/ and /var/cpanel/sessions/cache/.
5. Hunt for persistence: Audit cron entries, ~/.ssh/authorized_keys, custom WHM hooks, and packages installed during the exposure window.
6. If you cannot patch immediately: Block inbound TCP/2083, TCP/2087, TCP/2095, and TCP/2096 at the perimeter, or stop cpsrvd and cpdavd. This is the same containment several major hosting providers — including Namecheap, KnownHost, HostPapa, and InMotion — used to protect customers ahead of patching.

Lessons That Generalize Beyond cPanel

The cPanel vulnerability offers several lessons that apply to any web application with session management. First, sanitize at the sink, not the source. “Remember to call X before Y” rules will eventually be forgotten — the sanitizer should be inside the save function, not delegated to each caller. Second, never let untrusted input disable security checks. A falsy value should not silently turn off encryption; it should fail closed. Third, two representations of the same data is a vulnerability shape. Wherever a parser disagrees with another parser about what a byte sequence means — raw vs. cache, JSON vs. flat — that disagreement is exploitable. Finally, “already authenticated” flags need cryptographic binding. A boolean in a session that says “trust me, I already checked” must be bound to the thing that actually checked, or it can be forged.

For the broader hosting industry, the cPanel vulnerability exposed a systemic risk: when millions of websites depend on a single control panel platform, a single critical vulnerability in that platform becomes a vulnerability in the entire internet’s hosting infrastructure. Hosting providers that preemptively blocked cPanel ports did the right thing — just as firewall vendors who rushed to patch zero-day flaws did earlier this month — but the fact that such a measure was necessary reveals how concentrated the risk has become.

Frequently Asked Questions About the cPanel Vulnerability

What is CVE-2026-41940?

CVE-2026-41940 is a critical pre-authentication authentication bypass vulnerability in cPanel and WHM with a CVSS score of 9.8. It allows an unauthenticated remote attacker to gain root access to a cPanel server by exploiting a CRLF injection in the session writer combined with an encryption-skip triggered by a malformed cookie. The vulnerability existed in cPanel versions from 11.42 through the patched releases issued on April 28, 2026.

How many servers were affected by the cPanel vulnerability?

Approximately 1.5 million internet-facing cPanel and WHM instances were vulnerable, according to Shodan telemetry referenced by Rapid7. Internet scanner Censys identified 8,859 hosts with open directories showing files encrypted with the “.sorry” extension, with 7,135 confirmed as running cPanel or WHM. The Shadowserver Foundation detected over 44,000 unique cPanel-related IPs scanning or exploiting in a single day.

What is the Sorry ransomware?

Sorry ransomware is a ransomware group that emerged within 48 hours of CVE-2026-41940’s disclosure. It deploys a Go-based Linux encryptor that appends the “.sorry” extension to encrypted files and drops a ransom note instructing victims to contact the attackers via Tox-based chat. The ransomware uses three layers of encryption — AES-GCM for file contents, RSA for AES key encryption, and an embedded public key to lock the session RSA private key. It also spreads via SSH to other servers in the compromised host’s known_hosts file.

Was the cPanel vulnerability exploited before the patch was released?

Yes. According to hosting provider KnownHost, exploitation was observed as early as February 23, 2026 — roughly two months before cPanel’s emergency patch on April 28. This means CVE-2026-41940 was a true zero-day during that window. Any cPanel host that was internet-exposed and unpatched during that period should be treated as potentially compromised, not hypothetically.

Was the cPanel vulnerability used for nation-state attacks?

Yes. Ctrl-Alt-Intel threat researchers identified a cyber espionage campaign using CVE-2026-41940 to target government and military entities in Southeast Asia, including the Philippines, as well as MSPs and hosting providers in Laos, Canada, South Africa, and the United States. The campaign relied on public proof-of-concept code and targeted defense-sector portals in Indonesia and railway-sector data in China.

How do I check if my cPanel server was compromised?

Run the updated cPanel detection script, then manually inspect /var/cpanel/sessions/raw/ for session files containing user=root, hasroot=1, tfa_verified=1, or multiple pass= lines. Check access logs for 307 redirects to /cpsessXXXXXXXXXX/ without a preceding successful POST /login/. Audit WHM for unexpected user accounts, SSH keys, cron jobs, and packages installed during the February-to-May 2026 window. If indicators are found, rebuild from clean backups.

How do I patch the cPanel vulnerability?

Run /scripts/upcp –force to update cPanel, then verify the build version with /usr/local/cpanel/cpanel -V. Restart cpsrvd after updating. For servers with auto-update disabled, manually apply the patched version for your branch. After patching, rotate all root and reseller passwords, rotate API tokens, re-issue SSH keys, and purge all session files in /var/cpanel/sessions/raw/ and /var/cpanel/sessions/cache/.

What should I do if I cannot patch my cPanel server immediately?

Block inbound traffic on TCP ports 2083, 2087, 2095, and 2096 at your perimeter firewall, or stop the cpsrvd and cpdavd services. This is the same containment strategy used by major hosting providers including Namecheap, KnownHost, HostPapa, and InMotion ahead of patching. These ports serve cPanel, WHM, and webmail — blocking them temporarily prevents exploitation while you prepare the patch.

Cybersecurity Disclaimer: This article is for informational purposes only and does not constitute professional cybersecurity advice. Always consult with a qualified cybersecurity professional before making changes to your server infrastructure. The detection and mitigation steps described here are based on publicly available threat intelligence as of August 2026.