China's CVERC warns new "Sorry" ransomware exploits cPanel flaw CVE-2026-41940 against Linux servers

CVERC warned of multiple attacks in China by "Sorry", a ransomware family that emerged in 2026 and mainly targets internet-exposed Linux web servers ^[1]. Attackers exploit WebPros cPanel authorization flaw CVE-2026-41940 to gain admin rights, stop database and backup services, steal business data in bulk and then encrypt files, and the malware can spread actively ^[1]. CVERC advises checking versions and patches of exposed cPanel, WHM and Linux servers and upgrading to the latest release, keeping admin panels off the internet and maintaining offline backups ^[1].

Industries mainly affected: Cross-industry

1. Check exposed cPanel, WHM, WP Squared and Linux servers and patch CVE-2026-41940 ^[1].
2. Keep admin, remote-ops and database ports off the internet; use VPN or bastion hosts with allowlists and MFA ^[1].
3. Keep regular offline backups of sites, databases and configs .