The “Sorry” Ransomware Is Hitting cPanel Boxes, and the Fix Shipped Months Ago
imagine encrypting someone’s entire web host and then naming your ransomware “Sorry.” the apology is the brand. a campaign is chaining a cPanel authentication bypass into mass encryption of shared-hosting servers, 44,000-plus IPs by one count, and the patch that closes the door has been available since spring. the attackers are polite. the unpatched hosts are the punchline.
.sorry extension) has been encrypting cPanel-managed hosting at scale. Shadowserver and multiple hosting providers have reported tens of thousands of affected IP addresses. cPanel patched the flaw in versions 11.136.0.7 and the 136.1.7 / WP2 maintenance builds.the vulnerability, briefly
CVE-2026-41940 is an authentication bypass (CVSS 9.8) in cPanel & WHM. the practical effect: an attacker reaches administrative functionality without valid credentials, over the standard cPanel service ports exposed to the internet by design. once you are authenticated-equivalent on a shared-hosting control panel, you own every site on the box: file systems, databases, cron, mail. that is the ideal substrate for a ransomware operator, because one compromised panel can mean hundreds of customer websites encrypted at once.
the exposed ports to think about: 2082/2083 (cPanel), 2086/2087 (WHM), and 2095/2096 (webmail). if those are open to the whole internet on an unpatched build, you are the target demographic.
what “Sorry” does once it is in
- encrypts files across hosted accounts and appends a
.sorryextension (hence the name). - uses strong hybrid crypto: a stream cipher (ChaCha20-family) for file contents with an RSA-2048 key protecting the per-victim keys, so there is no free decryptor.
- drops a ransom note, typically a
README.mdin affected directories, with payment and contact instructions. - provides a contact channel over the Tox messenger rather than a clearnet site, which is becoming the norm for lower-overhead crews that do not want to run leak infrastructure.
*.sorry with a README.md ransom note dropped alongside. no quiet dwell, just mass encryption.how to tell if you are exposed (read-only, do this now)
none of this encrypts anything. it tells you whether the door is open. in a lab clone of a cPanel host we check the version banner and look for the known-bad indicators.
/usr/local/cpanel/cpanel -Vif that returns a build older than 11.136.0.7 (or the 136.1.7 / WP2 maintenance line your tier is on), you are behind on the fix for CVE-2026-41940. cPanel’s own auto-update normally handles this, which means a vulnerable banner usually also means auto-updates were disabled or stuck, a second finding worth chasing.
if you got hit: preserve before you rebuild
the instinct is to wipe and restore. do the forensics first, because you need to know how they got in (and whether backups are clean) before you trust a restore.
- isolate the host from the network but do not power it off if you can avoid it; capture volatile state first where feasible.
- preserve the ransom note (
README.md), a sample of.sorryfiles, cPanel access and error logs, WHM logs, auth logs, and web server logs with their timestamps. - record the Tox contact ID from the note for law enforcement and threat-intel sharing (do not negotiate on your own).
- check backups for integrity and for the same encryption before restoring onto a patched build. restoring onto the same unpatched version just feeds the next round.
- report to IC3 (ic3.gov) and, if you are a provider, notify affected customers.
the fix and the hardening
- patch: update cPanel & WHM to 11.136.0.7 or the maintenance build for your tier (136.1.7 / WP2 line). confirm auto-updates are actually running afterward.
- restrict the panel ports: limit
2083/2087/2096to known admin IPs or a VPN. a control panel does not need to answer the whole internet. - MFA on WHM and cPanel, and rotate any credentials that could have been exposed.
- offline, versioned backups that an attacker who owns the panel cannot reach or encrypt. if your backups live on the same box, they are not backups, they are future
.sorryfiles. - monitor for mass-rename activity: a spike in file modifications across many account directories, or sudden
README.mdcreation, is your earliest encryption alarm.
why this one stings
this is a May KEV entry still mowing down hosts in October. the patch is free, shipped automatically, and closes a 9.8. the only way to be a victim in Q4 is to have had auto-updates off or the server forgotten. shared hosting is where forgotten servers go to live, which is exactly why a crew built a ransomware business on top of it. the “Sorry” name is almost honest: the only apology owed is from whoever left auto-update disabled on a box holding hundreds of customer sites.
sloth take
ransomware named after an apology, running on a vulnerability patched six months ago, spreading because nobody looked at the update log. patch to 11.136.0.7, wall the panel ports off from the internet, keep backups somewhere the panel cannot reach, and alert on mass file renames. if you are a host and you are still on a vulnerable build, the attackers already wrote your apology for you.
Running cPanel shared hosting and want a fast exposure check plus an incident-ready preservation and recovery runbook? Book a slot with Dark Edge Consulting.
sources
- CVE-2026-41940 (cPanel & WHM authentication bypass, CVSS 9.8); CISA KEV addition May 1, 2026
- cPanel security advisory and fixed builds (11.136.0.7 and 136.1.7 / WP2 maintenance line)
- Shadowserver and hosting-provider reporting on the “Sorry” ransomware (.sorry extension, README.md note, Tox contact), 44,000+ affected IPs
- FBI IC3 (ic3.gov) ransomware reporting guidance; do-not-pay and preserve-evidence advisories
