A critical pre-authentication bypass, CVE-2026-41940, targeting cPanel/WHM has triggered a surge in malicious hosts. Active campaigns involve Mirai variants and ransomware appending “.sorry” to files. #cPanelFlaw #RansomwareAttack #MiraiBotnet
The cPanel Situation Is… - Censys
A critical pre-authentication bypass, CVE-2026-41940, was disclosed in cPanel/WHM and coincided with a sharp spike in hosts classified as malicious. Analysis indicates two active campaigns—post-compromise Mirai deployments and a large-scale file-encrypting campaign appending “.sorry” to files—heavily targeting cPanel systems. #CVE-2026-41940 #cPanel
www.hendryadrian.com
May 5, 2026 at 12:30 PM
A critical pre-authentication bypass, CVE-2026-41940, targeting cPanel/WHM has triggered a surge in malicious hosts. Active campaigns involve Mirai variants and ransomware appending “.sorry” to files. #cPanelFlaw #RansomwareAttack #MiraiBotnet