cPanel Flaw CVE-2026-41940 Exploited in Sorry Ransomware Attacks

A serious security flaw in cPanel — the software that millions of websites run on behind the scenes — is being actively exploited by hackers right now. Tracked as CVE-2026-41940, this vulnerability is being used in what researchers are calling “Sorry” ransomware attacks, where websites are broken into and their data is encrypted until a ransom is paid. As reported by BleepingComputer (one of the most-followed cybersecurity news outlets on LinkedIn with over 290,000 followers), the attacks are happening at scale, meaning this is not a small or isolated incident. If you own a website, run an online store, or work for a company that uses cPanel-based web hosting, this directly affects you.

What Is cPanel and Why Does It Matter?

If you have ever managed a website through your web hosting provider, there is a good chance you have used cPanel without even realising it. cPanel is a control panel — essentially a dashboard — that lets website owners manage their files, emails, databases, and domains all in one place. It is one of the most widely used hosting control panels in the world, powering millions of shared hosting accounts across providers in India, Saudi Arabia, the UAE, the UK, the United States, and everywhere in between.

Because cPanel sits at the heart of so many websites, a flaw in it is not a niche technical problem — it is a very big deal. When hackers find a weakness in cPanel, they effectively have a skeleton key to an enormous number of websites all at once. That is exactly what is happening right now with this cPanel ransomware flaw.

Small business owners, bloggers, e-commerce stores, digital agencies, and even university websites commonly use cPanel hosting. So when a vulnerability like this gets weaponised, the ripple effect touches real people and real businesses — not just faceless corporations.

What Is the “Sorry” Ransomware and How Does This Attack Work?

Ransomware is a type of attack where hackers break into a system, lock or encrypt all the data inside it, and then demand a payment — usually in cryptocurrency — before they will unlock it again. The “Sorry” ransomware is named after the message it leaves behind when it has finished encrypting your files. It is a taunting note that essentially says: your data is gone unless you pay up.

Here is how the attack works in simple terms. The cPanel ransomware flaw tracked as CVE-2026-41940 allows an attacker to get unauthorised access to a cPanel-based web server without needing a valid username or password. Once inside, they deploy the Sorry ransomware, which sweeps through the website’s files — including databases, uploaded content, emails, and configuration files — and encrypts all of it. The website goes offline. The business stops. And the hackers leave a ransom note.

What makes this especially dangerous is that it is being mass-exploited. That means hackers are not picking individual targets carefully — they are running automated tools that scan the internet for any server running a vulnerable version of cPanel and attacking them all simultaneously. This is not a targeted attack on one company. It is a dragnet, and thousands of websites could be caught in it.

BleepingComputer’s reporting confirms that exploitation is already underway, which means there is no time to wait. If your website runs on cPanel, the clock is ticking.

Who Is Most at Risk Right Now?

Anyone using a cPanel-based web hosting plan with an unpatched version of the software is potentially at risk. This is especially relevant for:

• Small and medium business owners in India, the UAE, Saudi Arabia, the UK, and the USA who rely on shared hosting for their websites
• Web developers and digital agencies managing multiple client websites on cPanel servers
• E-commerce store owners running WooCommerce, Magento, or OpenCart on shared hosting
• Bloggers and content creators who use hosting plans bundled with cPanel
• IT teams at companies that use self-managed or semi-managed cPanel-based servers

India in particular has a massive base of shared hosting users — millions of small businesses and startups rely on budget hosting providers that almost universally use cPanel. The UAE and Saudi Arabia similarly have thriving e-commerce and SME sectors heavily dependent on web hosting platforms built around cPanel. If you are in any of these regions and have not yet checked your hosting setup, now is the time.

5 Steps You Should Take Right Now

Fear is not helpful here — action is. Here is exactly what you should do, whether you are a website owner, a developer, or someone who manages hosting for a business:

1. Check your cPanel version immediately. Log into your cPanel dashboard and look for the version number, usually displayed at the bottom of the page. If you are on a shared hosting plan, contact your hosting provider and ask them directly whether they have patched CVE-2026-41940. A simple support ticket or live chat message is all it takes.
2. Apply the official cPanel patch without delay. cPanel has released a security update to address this flaw. If you manage your own server, update cPanel to the latest version right now. You can find update instructions and the official advisory on the cPanel documentation site. Do not postpone this — the attacks are already live.
3. Back up your entire website today. If you do not have a recent backup, create one immediately. Most cPanel dashboards include a built-in backup tool. Download your full backup to a location outside your hosting account — a local hard drive or a separate cloud storage account. If ransomware does hit, a clean backup is your best escape route.
4. Enable two-factor authentication (2FA) on your cPanel account. Even if you patch the vulnerability, good hygiene matters. Adding 2FA to your cPanel login means that even if someone gets hold of your password, they still cannot get in without a second verification step. This is a five-minute fix that adds a serious layer of protection.
5. Audit who has access to your hosting account. Check the list of users who have login access to your cPanel or any sub-accounts. Remove anyone who does not need access. Hackers sometimes use old or forgotten accounts as a way in. While you are there, change your main cPanel password to something long and unique if you have not done so recently.
6. Set up file change monitoring or a website firewall. Tools like Imunify360 (which many hosting providers already offer) or Sucuri’s website firewall can detect unusual file changes and block suspicious traffic before it causes damage. Ask your hosting provider if they offer any of these protections, or look into a third-party website security service. For more guidance, check out our how-to guides on keeping your website secure.

Bottom Line

A critical cPanel ransomware flaw (CVE-2026-41940) is being exploited right now in mass attacks that can take your website completely offline and hold your data for ransom. The fix exists — update your cPanel, back up your files, and contact your hosting provider today. Do not wait for this to become your problem before you act.