A cPanel Zero-Day Sat Open Two Months, Now Stealing Military Documents

A person typing on a laptop displaying lines of code in a dimly lit room — Photo via Unsplash

TL;DR: CVE-2026-41940 is an authentication bypass in cPanel and WHM with a CVSS of 9.8. cPanel runs an estimated 70 million domains. The bug was being exploited as a true zero-day from roughly February 23, 2026, two months before cPanel pushed an emergency patch on April 28. By April 30, the Shadowserver Foundation counted 44,000 IPs already brute-forcing honeypots with the public proof-of-concept. CISA added the bug to its Known Exploited Vulnerabilities list and gave federal agencies until May 3 to patch. At least three distinct threat groups are now using the bug in parallel: a ransomware operator that encrypts files with a .sorry extension, the nuclear.x86 Mirai variant, and an unidentified espionage actor that has already pulled documents from Philippine military domains, Laotian government servers, an Indonesian defense training portal, and the Chinese railway sector. If you run cPanel, you are not late to patch. You are late to incident response.

What CVE-2026-41940 Actually Does

cPanel and WHM (WebHost Manager) are the dashboards that small and mid-sized hosting providers hand to their customers to manage email, DNS, files, and databases. By cPanel's own count, the software runs roughly 70 million domains ^[1]. If you have ever bought hosting from Bluehost, Namecheap, HostGator, or any of a thousand resellers, you have probably touched cPanel.

CVE-2026-41940 is rated 9.8 out of 10, the ceiling that critical-severity vulnerabilities usually hit. The bug chains a CRLF injection in the session writer with an encryption-skip triggered by a malformed cookie, then exploits a race condition in how cPanel caches sessions. Net effect: an unauthenticated attacker can inject arbitrary key-value pairs into a session file, force the auth layer to trust them, and walk in as an administrator ^[2].

No credentials. No phishing. No interaction. Just a request crafted to a public-facing cPanel port.

The Timeline Is Brutal

Watchtowr Labs, which published the technical breakdown, dates active in-the-wild exploitation back to roughly February 23, 2026 ^[2]. cPanel did not push the emergency patch until April 28. That is more than two months in which sophisticated attackers had a reliable, unauthenticated remote-takeover bug for software running on tens of millions of public-facing servers.

Once the patch landed, it told attackers exactly where to look. Within 48 hours, public proof-of-concept code was circulating. Help Net Security and Shadowserver tracked roughly 44,000 IP addresses scanning and brute-forcing honeypots on April 30. By May 3 that number had dropped to 3,540 ^[3]. The drop is not a sign that the danger passed. It is a sign that the easy targets had already been hit.

CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities catalog and gave Federal Civilian Executive Branch agencies until May 3 to apply patches ^[4]. Federal deadlines do not bind the rest of the internet, which is the rest of the internet's problem.

The Ransomware Crew: ".sorry" Extension, Bitcoin Wallets, Tox Contact

Censys identified the first opportunistic abuse: a campaign that walks in through CVE-2026-41940, encrypts files on the host, and renames them with a .sorry extension. As of early May, Censys counted 8,859 hosts displaying the encrypted files, with 7,135 of them confirmed to be running cPanel or WHM ^[5].

Ransom demands range from 0.1 BTC up to undisclosed amounts in alternative cryptocurrencies. Contact instructions point victims to Tox messenger or Twitter handles. There is no central operator brand: it looks more like a small crew running through a list of exposed instances than an organized double-extortion outfit. That makes negotiation harder, not easier. There is no reputational pressure to actually deliver a decryptor ^[5].

If your cPanel host has files renamed with .sorry, restoring from backup is the only realistic path. Pay nothing. The actor has no incentive to give the keys back and no track record to suggest they would.

The Botnet: nuclear.x86 Mirai Variant Goes Hunting

HostMyCode documented a parallel campaign deploying the nuclear.x86 Mirai variant against vulnerable cPanel servers. Once on a host, the malware:

Creates backdoor accounts
Disables logging
Modifies firewall rules to keep the door open
Deploys cryptocurrency miners
Drops DDoS bot clients
Harvests credentials for lateral movement ^[3]

This is the standard Mirai playbook applied to a much higher-value target than the consumer routers and IoT cameras the family was built for. cPanel servers tend to host paying customers, so credentials harvested from one box can pivot to dozens of other unrelated services.

The Nation-State Operation: Philippine Military, Laos Government, Chinese Rail Data

The most serious activity tied to CVE-2026-41940 is not the ransomware or the botnet. It is a targeted espionage operation discovered by Ctrl-Alt-Intel on May 2 ^[6].

The unknown actor (operating from a single IP, 95.111.250[.]175, using public PoC code rather than a custom exploit) went after a specific set of victims:

Philippine government and military domains, including *.mil.ph and *.ph
Laotian government domains (*.gov.la)
Managed service providers and hosting providers in the Philippines, Laos, Canada, South Africa, and the United States
An Indonesian defense-sector training portal (via a separate custom exploit chain)

After establishing access, the actor moved laterally using OpenVPN and Ligolo tunneling, then ran the AdaptixC2 command-and-control framework to manage compromised endpoints. Exfiltration logs reviewed by Ctrl-Alt-Intel show the operation pulled "a substantial corpus of Chinese railway-sector documents," a detail that complicates simple attribution. A China-aligned actor stealing Chinese rail documents would be unusual. A regional rival doing it is more plausible ^[6].

Whoever this is, they got months of access while cPanel sat unpatched. That window is when the actual damage happened. The post-patch scanning is mostly cleanup and opportunism.

Why This One Hurts

Three reasons CVE-2026-41940 deserves more attention than it has gotten:

1. cPanel is the soft underbelly of the small-business internet. Enterprise hosts run their own custom panels. Hyperscalers run AWS, GCP, and Azure consoles. Everyone in the middle (local web shops, single-developer agencies, regional ISPs, every WordPress site bought for less than $200 a year) runs cPanel. That is the bulk of the public web by site count, and almost none of it has a 24/7 incident response team.

2. The two-month zero-day window is not an accident. The Watchtowr writeup makes clear this bug was exploitable for months before disclosure. That implies someone (or several someones) sat on it. Once a working exploit exists for software on 70 million domains, it gets sold, traded, and eventually leaked. By the time it shows up in a Shadowserver scan, the buyers who paid for exclusive access have already used it.

3. Hosting providers are the perfect pivot point. The Ctrl-Alt-Intel report flags MSPs and hosting providers in five countries. Compromise one of those, and you get downstream access to every customer they serve, including, in this case, government and military domains in jurisdictions where commercial hosting is the default for non-classified systems.

What to Do Right Now

If you administer a cPanel or WHM instance:

Patch immediately. Required versions: cPanel and WHM 110.0.x patched in 11.110.0.97; 118.0.x patched in 11.118.0.63; 126.0.x patched in 11.126.0.54 ^[7].
Run cPanel's updated detection script. The first version, released alongside the April 28 patch, generated excessive false positives. The May 2 update fixes that and looks for indicators specifically tied to CVE-2026-41940 exploitation.
Assume compromise on anything exposed before April 28. A patched server is not a clean server. Look for the indicators in the Watchtowr and Ctrl-Alt-Intel reports: unexplained admin accounts, modified firewall rules, OpenVPN or Ligolo binaries, AdaptixC2 traffic, and files renamed with the .sorry extension.
Rotate every credential the box ever held. Mirai's nuclear.x86 variant harvests credentials. Anything stored, hashed, or remembered on a compromised cPanel instance is gone. Treat it as gone.
Notify customers if you are an MSP or host. The targeting pattern shows downstream pivot is the goal. Your customers need to know, including the ones with government domains.

If you are a customer of a small hosting provider: ask them, in writing, whether they patched CVE-2026-41940 and whether they have run an indicator-of-compromise scan. The legitimate ones will answer quickly. The ones who do not are telling you something.

Sources

Published: May 4, 2026