Critical cPanel Vulnerability Exploited in Mass “Sorry” Ransomware Campaign
A severe security vulnerability in cPanel, one of the world’s most widely deployed web hosting control panels, is currently being exploited at scale by threat actors deploying a new ransomware strain dubbed “Sorry.” The attacks, which began surfacing in early May 2026, have already compromised thousands of websites globally, leaving businesses scrambling to recover encrypted data and restore services.
This developing situation represents a significant threat to the hosting industry and the millions of websites that rely on cPanel for server management. With exploitation already widespread, organisations must act immediately to assess their exposure and implement protective measures.
What Happened
Security researchers and hosting providers began reporting a surge in ransomware incidents targeting cPanel-managed servers in late April 2026. The attacks were traced back to a critical vulnerability now tracked as CVE-2026-41940, which allows unauthenticated remote attackers to gain privileged access to affected systems.
“A new disclosed cPanel flaw tracked as CVE-2026-41940 is being mass-exploited to breach websites and encrypt data in ‘Sorry’ ransomware attacks.”
Source: BleepingComputer
The “Sorry” ransomware, named after the ransom note it leaves on compromised systems, appears to be operated by a previously unknown threat actor. Victims report that encrypted files receive a .sorry extension, and ransom demands have ranged from several thousand to hundreds of thousands of dollars in cryptocurrency, depending on the perceived value of the target.
The campaign has been particularly devastating because cPanel’s ubiquity in the shared hosting environment means that a single compromised server can affect dozens or even hundreds of individual websites. Hosting providers across Australia, North America, Europe, and Asia have reported incidents, indicating a truly global attack campaign.
Technical Analysis
CVE-2026-41940 is classified as a critical vulnerability with a CVSS score of 9.8, reflecting its severity and ease of exploitation. The flaw exists in cPanel’s authentication handling mechanism, specifically within the web-based management interface.
Vulnerability Details
Based on available technical information, the vulnerability allows attackers to:
- Bypass authentication controls without valid credentials
- Execute arbitrary code with root-level privileges
- Access all hosted accounts on the affected server
- Modify system configurations and install persistent backdoors
The attack chain observed in the wild typically follows this pattern:
- Initial Access: Attackers scan for vulnerable cPanel installations and exploit CVE-2026-41940 to gain administrative access
- Privilege Escalation: The vulnerability grants immediate root access, eliminating the need for additional exploitation
- Lateral Movement: Attackers enumerate all hosted accounts and websites on the server
- Data Exfiltration: Sensitive data, including databases and configuration files, may be stolen before encryption
- Ransomware Deployment: The “Sorry” ransomware payload is executed, encrypting website files, databases, and backup archives
Affected Versions
The vulnerability affects cPanel & WHM versions prior to the security patches released in late April 2026. Organisations running outdated versions are at immediate risk. cPanel has released emergency patches addressing this vulnerability, and all users are urged to update immediately.
Business Impact
The ramifications of this vulnerability extend far beyond technical inconvenience. For Australian businesses and organisations worldwide, the potential impacts include:
Operational Disruption
Encrypted websites and databases mean complete business disruption for online operations. E-commerce platforms, customer portals, and web applications become inaccessible, directly impacting revenue and customer relationships.
Financial Consequences
Beyond ransom demands, affected organisations face costs including incident response, forensic investigation, system restoration, potential regulatory fines, and reputational damage. For shared hosting providers, the liability exposure is particularly severe, as they may be responsible for numerous client websites.
Regulatory and Compliance Implications
Australian organisations must consider their obligations under the Privacy Act 1988 and the Notifiable Data Breaches scheme. If personal information has been compromised—which is likely given the nature of these attacks—mandatory notification requirements may apply. Similar obligations exist under GDPR for organisations handling European data.
Supply Chain Risk
Many businesses rely on third-party hosting providers managing cPanel environments. This vulnerability highlights the importance of understanding and managing supply chain cybersecurity risks.
Actionable Recommendations
OziTechs recommends organisations take the following immediate and ongoing actions:
Immediate Actions
- Patch Immediately: Update all cPanel installations to the latest patched version without delay. This is the single most critical step.
- Assess Exposure: Inventory all systems running cPanel, including those managed by third-party providers, and verify patch status.
- Review Logs: Examine authentication logs, access logs, and system logs for indicators of compromise, particularly unusual administrative access or file modifications.
- Verify Backup Integrity: Confirm that offline or immutable backups exist and have not been compromised. The “Sorry” ransomware is known to target backup files.
- Implement Network Segmentation: Restrict administrative access to cPanel interfaces to trusted IP addresses only.
Ongoing Security Measures
- Enable multi-factor authentication for all administrative accounts
- Implement a robust vulnerability management programme with rapid patching capabilities
- Deploy endpoint detection and response (EDR) solutions on hosting infrastructure
- Establish and regularly test incident response procedures
- Consider engaging managed security services for 24/7 monitoring
Key Takeaways
- CVE-2026-41940 is a critical cPanel vulnerability with a CVSS score of 9.8, enabling unauthenticated remote code execution with root privileges.
- Mass exploitation is actively occurring through the “Sorry” ransomware campaign, affecting thousands of websites globally.
- Shared hosting environments are particularly vulnerable, as a single compromised server can impact hundreds of websites.
- Immediate patching is essential—organisations must update cPanel installations and verify third-party provider compliance.
- Offline, immutable backups are critical for ransomware recovery, as attackers specifically target accessible backup systems.
Conclusion
The mass exploitation of CVE-2026-41940 in “Sorry” ransomware attacks serves as a stark reminder of the critical importance of timely vulnerability management and robust security practices. For the millions of websites relying on cPanel infrastructure, the window for protective action is rapidly closing.
Organisations must treat this as a priority security incident, regardless of whether they have observed signs of compromise. The combination of a trivially exploitable vulnerability and active ransomware deployment creates a perfect storm that demands immediate attention.
If your organisation requires assistance in assessing exposure, implementing patches, or responding to a potential compromise, OziTechs’ incident response team is available to provide immediate support. Contact us to discuss your security posture and ensure your web infrastructure is protected against this and future threats.