Emergency Alert: CVE-2026-41940 cPanel Vulnerability Fuels “Sorry” Go Ransomware

Sorry ransomware exploits cPanel CVE-2026-41940, written in Go with static linking for cross-platform execution on Linux and Xinchuang OS. Includes SSH hardening checklist and mitigation steps.

Emergency Alert: CVE-2026-41940 cPanel Vulnerability Fuels “Sorry” Go Ransomware — Xinchuang and Linux Servers Under Triple-Chain Attack

Risk Scan

Schedule an immediate audit if your operations environment meets any of these conditions:

  • cPanel / WHM panel accessible from the public internet
  • Linux servers still allowing SSH password authentication
  • Xinchuang (domestic OS) environments without ransomware response plans
  • Critical business data lacking offline backups

This is not a drill. In August 2026, China’s National Computer Virus Emergency Response Center issued an urgent bulletin regarding the “Sorry” ransomware family.

Attack Mechanism: One Vulnerability Unlocks an Entire Chain

Sorry ransomware attack chain: cPanel vulnerability → Go ransomware delivery → .sorry encryption → SSH lateral movement

Entry Point: cPanel Authorization Bypass

CVE-2026-41940 is an authorization vulnerability in WebPros cPanel. An attacker can obtain administrative privileges without any valid credentials — simply by sending a crafted request to a specific API endpoint. cPanel/WHM panels typically run on ports 2082, 2083, 2086, and 2087. If exposed to the public internet without the latest patch, they are effectively unlocked front doors.

Payload: Cross-Platform Ransomware Built in Go

Once inside, the attacker deploys the “Sorry” ransomware binary. Written in Go, it exhibits several technically significant characteristics:

  • Statically linked: All runtime dependencies are embedded. No reliance on the target system’s shared libraries — it runs on any Linux distribution immediately.
  • Cross-architecture compatible: The same binary executes on both x86_64 and ARM64 systems.
  • Process masquerading: After execution, it renames itself to sshd, blending into the native process list. Standard ps checks are unlikely to flag it.

Encryption Behavior

The ransomware traverses accessible filesystem directories, encrypts matching file types, and appends .sorry to the original filename. The encryption uses an AES + RSA hybrid scheme. Without the attacker’s private key, decryption is effectively impossible.

Lateral Movement Via SSH Weak Passwords

What separates “Sorry” from traditional single-host ransomware is its propagation capability. After infecting one host, it:

  1. Reads local SSH client configuration files (known_hosts, config)
  2. Scans shell history (bash_history, zsh_history) to identify commonly connected targets
  3. Attempts SSH logins to internal hosts using a dictionary of common weak passwords
  4. Repeats the encryption and propagation cycle on each successful connection

A single compromised host can rapidly escalate into a full network breach.

Xinchuang Environment Risk Assessment

Domestic operating systems (Kylin, UOS, Anolis OS, openEuler) are built on the Linux kernel and use the ELF executable format. “Sorry” is statically compiled in Go — it does not depend on glibc version differences or specific shared libraries — and therefore runs on these systems without modification.

Additional risk factors specific to Xinchuang environments include:

  • Operational habits still in transition: Some teams carry forward the “intranet equals safe” assumption from the Windows era, leaving SSH configurations unhardened.
  • Inadequate incident response readiness: Ransomware drills and detection tool deployment specifically for Linux/Xinchuang environments remain low.
  • Patch management lag: Security updates for infrastructure components like cPanel often trail behind public advisories in Xinchuang cloud deployments.

Mitigation Guide

Immediate Diagnostic Commands

Check cPanel version and exposure:

/usr/local/cpanel/cpanel -V
ss -tlnp | grep -E ':(2082|2083|2086|2087|2089)'

Verify sshd process authenticity:

ls -la /proc/$(pgrep -o sshd)/exe

Expected output: /usr/sbin/sshd. Any other path requires immediate host isolation.

Scan for .sorry files:

find / -name "*.sorry" -type f 2>/dev/null
find / -mmin -60 -type f -name "*.sorry" 2>/dev/null

Audit SSH configuration:

grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config

Blocking Measures

1. Patch the entry point — update cPanel and restrict access:

/usr/local/cpanel/scripts/upcp --force
iptables -A INPUT -p tcp --dport 2087 -s YOUR_MGMT_NET -j ACCEPT
iptables -A INPUT -p tcp --dport 2087 -j DROP

2. Eliminate lateral movement conditions — harden SSH:

# /etc/ssh/sshd_config critical settings
PermitRootLogin no
PasswordAuthentication no
Port 22022
MaxAuthTries 3

Replacing password authentication with SSH keys is the single most effective measure — it renders weak-password brute force attacks irrelevant.

3. Deploy continuous monitoring:

inotifywait -m -r --include '.*.sorry$' /home /var/www /opt &
freshclam && clamscan -r --infected /home /var/www /opt

4. Validate backups: Confirm that critical data follows the 3-2-1 backup rule (3 copies, 2 media types, 1 offline), and that backup storage is physically isolated from the production network.

DELine Security Services

The damage from a ransomware attack is largely determined by how prepared you were before it happened.

DELine delivers enterprise-grade security capabilities for corporate and government clients:

  • Infrastructure security assessment: Configuration audit and risk quantification for cPanel, SSH, firewalls, and other critical components
  • Security baseline hardening: OS-to-application layer hardening with auditable compliance configurations
  • Intrusion detection and response: File integrity monitoring, anomaly traffic detection, and automated response rules
  • Ransomware response drills: Simulated attack-chains to validate backup recovery procedures and team responsiveness
  • Xinchuang environment assessment: Security adaptation and hardening for domestic operating systems

To initiate a security assessment or request incident response support, contact the DELine security team via www.de-line.net.

Related Posts