Massive Malware Attack Exploits cPanel Flaw
A critical flaw in cPanel, tracked as CVE-2026-41940, has led to widespread ransomware attacks, specifically targeting websites. The “Sorry” ransomware is being deployed across thousands of compromised servers, with over 44,000 IP addresses already affected.
This vulnerability, which allows attackers to bypass authentication, was quickly exploited following an emergency update from cPanel released this week. Victims report their files being encrypted with a “.sorry” extension, rendering them inaccessible without a specific decryption key.
The impact is significant, with numerous websites already compromised and indexed on Google. A ransom note instructs victims to negotiate payments with the attackers, making recovery difficult.
To protect against this threat, all cPanel and WHM users should immediately update their software. The risk level for this attack is categorized as High, as ongoing exploitation is expected in the coming days.
Source: View Original Report
