# cPanel authentication bypass exploited for Sorry ransomware

Published: 2026-05-04 · Severity: critical · Sectors: technology, government-national, defense
Canonical: https://vorant.io/reports/d6f3774d-f82c-57db-bdc2-da9caeede245/cpanel-authentication-bypass-exploited-for-sorry-ransomware

> Threat actors are actively exploiting CVE-2026-41940, an authentication bypass in cPanel/WHM, to deploy Sorry ransomware, Mirai botnets, and conduct espionage since February 2026.

A critical authentication bypass vulnerability in cPanel, WHM, and WP Squared (CVE-2026-41940) is under active exploitation by multiple threat actors. The flaw allows unauthenticated remote attackers to gain full administrative access and achieve root-level remote code execution through a simple exploit chain requiring only a few HTTP requests and no credentials. According to KnownHost CEO Daniel Pearson, exploitation began as early as February 23, 2026—approximately two months before cPanel issued emergency patches on April 28, 2026.

Following public disclosure by watchTowr Labs, which included technical analysis and proof-of-concept code, exploitation has escalated significantly. Threat actors have deployed a Go-based Linux encryptor associated with the "Sorry" ransomware campaign, installed Mirai botnets, conducted credential harvesting operations, and targeted government and military entities in Southeast Asia for cyber espionage. Shadowserver reported 44,000 IP addresses associated with active scanning and exploit activity. CISA has added CVE-2026-41940 to its Known Exploited Vulnerabilities Catalog.

The vulnerability affects multiple cPanel & WHM versions from 11.86.0 through 11.136.0, as well as WP Squared versions prior to 136.1.7. Organizations running these web hosting control panels face immediate risk of compromise and should apply vendor patches urgently. The widespread adoption of cPanel in hosting environments and the availability of public exploit code make this a particularly dangerous threat requiring immediate remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-41940 (KEV)
- Malware: Mirai, Sorry

## Detection guidance (public sample)

### cPanel/WHM Web Service Spawning Shell or Scripting Interpreter

ATT&CK: T1190

Detects cPanel/WHM daemon processes (cpsrvd, whostmgrd) spawning shell or interpreter child processes, indicative of post-exploitation command execution following the CVE-2026-41940 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: cPanel/WHM Web Service Spawning Shell or Scripting Interpreter
id: cc173231-6fa1-5885-b583-2152ea046f55
status: experimental
description: Detects cPanel/WHM daemon processes (cpsrvd, whostmgrd) spawning a shell
  or scripting interpreter, consistent with remote code execution following exploitation
  of the CVE-2026-41940 authentication bypass.
references:
- https://attack.mitre.org/techniques/T1190/
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - cpsrvd
    - whostmgrd
    - cpanel
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
    - /curl
    - /wget
  filter:
    CommandLine|contains:
    - /usr/local/cpanel/scripts/
    - /usr/local/cpanel/bin/
  condition: selection and not filter
falsepositives:
- Legitimate cPanel maintenance scripts invoking interpreters from known internal
  script paths
- Scheduled cPanel background tasks or cron-triggered internal utilities
level: high
```

### Payload Download via cPanel Service Process

ATT&CK: T1190

Detects curl/wget invoked as a child of cPanel/WHM daemon processes to fetch a remote payload, a common step after exploiting the CVE-2026-41940 authentication bypass to deploy Sorry ransomware or Mirai binaries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Payload Download via cPanel Service Process
id: e96e4abc-655d-5432-95cc-2438b24989dd
status: experimental
description: Detects curl or wget spawned by cpsrvd/whostmgrd downloading remote content,
  consistent with fetching a second-stage payload (ransomware encryptor or Mirai bot)
  after exploiting CVE-2026-41940.
references:
- https://attack.mitre.org/techniques/T1190/
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - cpsrvd
    - whostmgrd
    - cpanel
    Image|endswith:
    - /curl
    - /wget
    CommandLine|re: (https?://|ftp://)
  condition: selection
falsepositives:
- cPanel license or update check scripts that legitimately call curl/wget for vendor
  endpoints
- Automated backup or plugin update routines invoked directly by cPanel daemons
level: high
```

### Downloaded Binary Made Executable and Run from Temp Path by Web Process Tree

ATT&CK: T1190

Detects chmod +x followed by execution of a binary located in a world-writable temp directory within the process tree of a cPanel/WHM service, matching the drop-and-execute pattern used to deploy ransomware or Mirai payloads post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Downloaded Binary Made Executable and Run from Temp Path by Web Process Tree
id: d2426be3-f6bd-5191-8295-6e3701cfd7b4
status: experimental
description: Detects a chmod +x command targeting a file in a temporary or web-writable
  directory, executed within the process ancestry of a cPanel/WHM web service, indicating
  a dropped payload is being prepared for execution after exploitation of the CVE-2026-41940
  authentication bypass.
references:
- https://attack.mitre.org/techniques/T1190/
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /chmod
    CommandLine|contains: +x
    CommandLine|re: (/tmp/|/var/tmp/|/dev/shm/|/home/[^/]+/public_html/)
  ancestor_filter:
    ParentImage|contains:
    - cpsrvd
    - whostmgrd
    - cpanel
  condition: selection and ancestor_filter
falsepositives:
- Legitimate cPanel installer or plugin scripts that set executable permissions on
  files within hosting account directories
- WHM autoinstall routines that stage and chmod helper binaries during normal operation
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-whm-cpanel-and-wp-squared-could-allow-for-remote-code-execution_2026-042

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d6f3774d-f82c-57db-bdc2-da9caeede245/cpanel-authentication-bypass-exploited-for-sorry-ransomware.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup