cpanel & whm login bypass exploited months before the patch

what happened

• On April 28, 2026, cPanel published a security update for CVE-2026-41940, an authentication bypass in the login flow that affects all cPanel & WHM versions after 11.40, including DNSOnly, and WP Squared.[1,2]
• The NVD record carries VulnCheck scores of 9.8 (CVSS v3.1) and 9.3 (CVSS v4.0) and classifies the flaw as CWE-306, missing authentication for a critical function.[2]
• Fixed builds include 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20 and 11.136.0.5, plus WP Squared 136.1.7.[1]
• CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog on 2026-04-30 with a 2026-05-03 due date, and lists it as known to be used in ransomware campaigns.[3,2]
• Help Net Security reported that attackers had been spotted exploiting the flaw since February 23, months before cPanel's April 28 advisory. Rapid7, quoted in the same report, explained that attackers can inject raw \r\n characters through a malicious basic authorization header into the session file cpsrvd writes before authentication.[4]
• BleepingComputer reported that attackers used the flaw to deploy a Go-based Linux encryptor dubbed "Sorry" that appends .sorry to encrypted files.[5]
• Rapid7, cited by Help Net Security and SecurityWeek, counted about 1.5 million cPanel instances exposed to the internet on Shodan, and Shadowserver told Help Net Security it saw around 650,000 IPs hosting exposed cPanel/WHM instances.[4,6]
• cPanel published a detection script, ioc_checksessions_files.sh, that scans /var/cpanel/sessions/raw for injected session data, and advises purging affected sessions and forcing password resets for root and all WHM users if indicators are found.[1]