Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks

A critical vulnerability in cPanel, identified as CVE-2026-41940, is being widely exploited by attackers to compromise websites and deploy "Sorry" ransomware, resulting in encrypted data¹. This flaw has significantly expanded the active attack surface, allowing malicious actors to breach websites and demand ransom payments. The mass exploitation of this vulnerability underscores the importance of prompt patching and mitigation measures to prevent such attacks. cPanel users are advised to assess their exposure to this vulnerability and take immediate action to protect their systems. The exploitation of CVE-2026-41940 highlights the need for proactive security measures, including regular updates and vulnerability scans, to prevent ransomware attacks. So what matters to practitioners is that they must prioritize patching this vulnerability based on their exposure and exploitation evidence to prevent similar breaches.