cPanel and WHM login bypass used in ransomware attacks: confirm your server is patched
A critical cPanel & WHM flaw let attackers into control panels without a password. It was mass exploited. Check that your host patched.
Affects:cPanel & WHM before late April 2026WP Squared before 11.136.1.7
In late April 2026, cPanel released an emergency security update for cPanel & WHM to fix CVE-2026-41940, a flaw in the login process. It allowed a remote attacker to get into the control panel without a valid password. The CVE record was published on 29 April 2026 with a CVSS 3.1 score of 9.8 out of 10.
The flaw was used before a fix existed. BleepingComputer reported exploitation attempts going back to late February 2026, and attacks that installed a ransomware called "Sorry", which encrypts files and adds a .sorry extension. The US agency CISA added the flaw to its catalog of exploited vulnerabilities on 30 April 2026 and marks it as known to be used in ransomware campaigns. WP Squared, a WebPros panel for WordPress hosting, was affected too.
Who is affected
Servers running cPanel & WHM from version 11.40 up to the first patched build of each release line. The fixed builds listed in the CVE record include 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20 and 11.136.0.5 (cPanel usually writes these without the leading 11, for example 136.0.5). WP Squared is fixed in 11.136.1.7.
If your site is on shared hosting with cPanel, the server belongs to your host and updating it is their job. If you run your own VPS with WHM, it is yours.
How to check your site
- Log in to cPanel. The version is usually shown in the "General Information" panel on the home page. Compare it with the fixed build for the same line.
- On your own server, WHM shows the version in its interface. A version older than the fixed build of its line means the server was never patched.
- Look for warning signs: files suddenly renamed with a .sorry extension, an unexpected README.md ransom note, or cPanel accounts, email accounts or FTP users you did not create.
What to do now
- Ask your host to confirm in writing that the server was updated to a fixed build in late April 2026 or later, and whether they found signs of intrusion.
- If you manage a VPS, update cPanel & WHM from WHM now and keep automatic updates enabled.
- If you see any warning sign, change your cPanel, email, FTP and database passwords, and restore from a clean backup made before the intrusion, with your host's help.
- Keep at least one recent backup outside the server.
Hosts generally patched within days of the update, so a server updated since then is most likely protected, but it is worth a check. This alert reports what the sources listed below published and is not a guarantee about any specific site.