🛡️ CISO Intel — Monday, 04-05-2026

By Marcus Reed | 03-05-2026 08:00 IST → 04-05-2026 08:00 IST | Sources cross-referenced

Executive Summary

The weekend’s calm was deceptive, as threat actors, particularly ransomware groups, ramped up operations, leveraging a critical, pre-authentication vulnerability in cPanel/WHM (CVE-2026-41940) for mass exploitation. This flaw, with a CVSS score of 9.8, grants unauthenticated root access and has been actively exploited since February, leading to widespread “Sorry” ransomware deployments and Mirai botnet recruitment. Compounding this, a CVSS 10.0 RCE impacting AI/LLM infrastructure via Flowise (CVE-2025-59528) signals a dangerous evolution in targeting. CISOs must prioritize immediate patching of cPanel/WHM and Flowise, conduct thorough compromise assessments, and reinforce defenses against a relentless ransomware ecosystem.

🔴 Critical Threats — Act Now

cPanel/WHM Authentication Bypass Fuels “Sorry” Ransomware & Mirai Botnets 🚨

What happened: A critical pre-authentication vulnerability, identified as CVE-2026-41940 (CVSS v3.1: 9.8, CVSS v4.0: 9.3), has been discovered and is being actively mass-exploited in cPanel & WHM, the ubiquitous web hosting control panel software, and its derivative, WP Squared. This flaw allows unauthenticated remote attackers to bypass the login process entirely and gain root-level administrative access to affected systems. What’s particularly alarming is that evidence suggests this vulnerability has been exploited as a zero-day since at least February 23, 2026, a full two months before its public disclosure and the release of patches on April 28, 2026.

The primary actors leveraging this vulnerability are the “Sorry” ransomware group, deploying Linux encryptors, and other threat actors installing a Mirai variant (“nuclear.x86”) for botnet recruitment. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41940 to its Known Exploited Vulnerabilities (KEV) catalog on May 1, 2026, with a remediation deadline of May 3, 2026, for federal agencies, underscoring the urgency of this threat.

Source verification: This incident is thoroughly confirmed across multiple reputable sources including Rapid7, Help Net Security, Hadrian.io, TrendAI, Bleeping Computer, cPanel’s own security advisory, NVD, Rod’s Blog, SecurityWeek, Hackread, Lockbit Decryptor, Cato Networks, Malwarebytes, CyCognito, Dataminr, and the Cyber Security Agency of Singapore. There are no conflicting reports; all sources confirm the critical nature, active exploitation, and the details of the attack.

Technical breakdown: The vulnerability, mapped to CWE-306 (Missing Authentication for Critical Function), stems from a Carriage Return Line Feed (CRLF) injection flaw within the login and session handling logic of the cpsrvd (cPanel service daemon). Before authentication, cpsrvd writes a new session file to disk. An attacker can craft a malicious basic authorization header to inject raw \r\n characters. This allows them to manipulate the whostmgrsession cookie by omitting an expected segment of its value, bypassing the encryption process normally applied to user-provided data.

By injecting arbitrary properties like user=root and hasroot=1 into their session file, and exploiting a race condition between the raw text file and JSON cache session storage, the attacker’s injected data persists and is trusted by the authentication layer. This effectively promotes the attacker to a fully authenticated administrator with root privileges without needing valid credentials. A Proof-of-Concept (PoC) exploit was published by security firm watchTowr on April 29, 2026, further accelerating widespread exploitation.

The attack chain observed in the wild is fully automated, happening within minutes from initial access to ransomware deployment. Crucially, this bypasses both password and two-factor authentication. Post-compromise, attackers establish persistence by changing the root password, creating new UID=0 users, adding SSH public keys, enabling password authentication on SSH, and opening additional SSH ports. They also perform extensive reconnaissance, searching for sensitive data like AI API keys (Anthropic, OpenAI), cloud credentials (AWS), and payment processor keys (Stripe).

Blast radius: The exposure is immense. Shodan queries reveal approximately 1.5 million cPanel instances accessible via the internet that may be vulnerable. All currently supported versions of cPanel & WHM after 11.40 are affected, as well as WP Squared version 136.1.7. Successful exploitation grants complete control over the WHM administrative interface with root privileges, access to all hosted cPanel accounts, theft/modification/deletion of websites, email, and databases, deployment of webshells, malware, or ransomware, and lateral movement within the network. DFIR teams have reported over 15,000 newly compromised cPanel hosts in a single day, with a concentration on VPS and cloud providers like DigitalOcean, Contabo, and OVH.

The “Sorry” ransomware deployed is a Go-based Linux encryptor that uses ChaCha20 for file encryption, with the key protected by RSA-2048. Encrypted files receive a .sorry extension, and a README.md ransom note directs victims to contact attackers via Tox. While some reports suggest it’s a variant of the Chaos ransomware family and may have decryption flaws allowing for manual restoration or use of public decryptors, this does not diminish the immediate threat of data loss and operational disruption.

Marcus’s verdict:

This isn’t just another CVE; this is a full-blown crisis for anyone running cPanel/WHM. A pre-authentication root bypass, actively exploited as a zero-day for months, is the stuff of nightmares. The fact that it bypasses 2FA is a stark reminder that even robust authentication mechanisms can be rendered useless by fundamental flaws in session management. The “Sorry” ransomware group is hitting hard, and the collateral damage from Mirai botnet infections will be significant. If you’re a hosting provider, you’re the new soft underbelly, and your customers are relying on you. This isn’t a “patch when you can” situation; this is a “patch now and assume compromise” scenario. The impact is total system takeover, data exfiltration, and full operational disruption. The search for AI API keys and cloud credentials post-compromise also highlights a growing trend: threat actors are not just after your data, but your access to broader cloud ecosystems.

What to do:

1. Immediate Patching: Update all cPanel & WHM instances to the patched versions immediately. These include 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.136.0.5, and WP Squared 136.1.7. Use /scripts/upcp --force and restart cpsrvd.
2. Compromise Assessment: Assume compromise if your cPanel/WHM instance was internet-exposed between February 23, 2026, and April 28, 2026, and has not been patched.
   • Utilize cPanel’s provided detection script to check for Indicators of Compromise (IOCs) in session files.
   • Look for unexpected entries in /var/cpanel/sessions/raw/ (e.g., multiple pass= lines, user=root or hasroot=1 on non-root sessions).
   • Scan for unusual root-level processes, unexpected SSH keys in authorized_keys, and unexpected cron jobs.
   • Look for the Mirai binary “nuclear.x86”.
3. Credential Rotation: Rotate all administrative credentials (cPanel, WHM, root, database, WordPress, SSH) for any potentially affected systems.
4. API Key Rotation: Immediately rotate all AI API keys (Anthropic, OpenAI), cloud credentials (AWS), and payment processor keys (Stripe) if these were stored on or accessible from affected servers.
5. Network Hardening: If immediate patching is not possible, block inbound traffic on cPanel/WHM administrative ports (2083, 2087, 2095, 2096) at the firewall. Consider stopping cpsrvd and cpdavd services as a temporary measure.
6. Backup & Recovery: Ensure robust, immutable backups are in place and tested. Be prepared for full system restoration. If hit by “Sorry” ransomware, investigate potential decryption flaws before considering ransom payment.

🛡️ CVEs — Full Analysis

CVE-2025-55182 — Unspecified Product

Summary: This CVE is listed with a CVSS score of 10.0 and a known exploit. However, despite extensive searches, no publicly available information regarding the affected product, technical details, or a verifiable source could be found within the specified search window. CVSS/Details: CVSS 10.0 (Critical). Known exploit: Yes. Product: Unspecified. Marcus take:

⚠️ Unverified: This is a glaring red flag. A CVSS 10.0 with a known exploit is the highest alarm, but without any product details or verifiable sources, it’s impossible to act on. It’s either extremely fresh, highly targeted, or an intelligence anomaly. Security teams should monitor for updates on this CVE identifier, but do not panic. Do not chase shadows. Focus on the confirmed, actively exploited threats.

CVE-2025-59528 — Flowise

Summary: A critical Remote Code Execution (RCE) vulnerability exists in Flowise, a popular open-source low-code tool for building customized LLM orchestration flows. The flaw resides in the CustomMCP node within the AI model UI, allowing attackers to execute arbitrary code. CVSS/Details: CVSS 10.0 (Critical). Affects Flowise versions 3.0.5 and 2.2.7-patch.1 to < 3.0.6. PoC: Yes. Marcus take:

This is a direct hit on the rapidly expanding AI/LLM infrastructure. A CVSS 10.0 RCE in a tool designed to build AI flows means an attacker could potentially hijack the very intelligence layer of your applications. Given the increasing reliance on LLMs, this is a severe supply chain risk for AI development. Patching is non-negotiable, and a full audit of any Flowise-built applications for post-exploitation indicators is essential.

CVE-2025-59718 — Fortinet FortiOS Network

Summary: A critical vulnerability with a known exploit affecting Fortinet FortiOS. While specific technical details on the impact are sparse, the presence of a known exploit for a Fortinet product always warrants immediate attention due to their widespread use in network perimeter defense. CVSS/Details: CVSS 9.8 (Critical). Exploit known: Yes. PoC: Yes. Marcus take:

Fortinet vulnerabilities, especially those with public exploits, are always high-priority. These are often gateway vulnerabilities that lead to network compromise. While the specifics are still emerging, assume the worst: unauthenticated access or remote code execution. If you’re running FortiOS, check your vendor advisories now and prepare for rapid patching. This is how initial access brokers get their footholds.

CVE-2026-42779 — Apache MINA

Summary: This vulnerability allows for Full Object Deserialization RCE via AbstractIoBuffer.resolveClass() by bypassing the acceptMatchers filter in Apache MINA, a network application framework. CVSS/Details: CVSS 9.8 (Critical). Published ~10 hours ago. PoC: Unclear from initial reports, but the nature of deserialization RCE often leads to rapid PoC development. Marcus take:

Deserialization vulnerabilities are classic RCE vectors, and bypassing filters like acceptMatchers indicates a fundamental design flaw or an oversight in the security controls. Apache MINA is a foundational library for many network applications, meaning the blast radius could be significant across various enterprise software. If your applications use Apache MINA, this is a serious concern. Review dependencies and prepare for a patch.

CVE-2026-42778 — Apache MINA

Summary: A related vulnerability to CVE-2026-42779, this is a CWE-502 Deserialization of Untrusted Data flaw in Apache MINA. It was published concurrently and is likely part of the same underlying issue. CVSS/Details: CVSS 9.8 (Critical). Published ~10 hours ago. PoC: Unclear. Marcus take:

Two critical deserialization RCEs in the same component, published at the same time, usually point to a coordinated disclosure of a complex attack chain or multiple facets of the same core problem. Treat CVE-2026-42778 and CVE-2026-42779 as a single, urgent threat. The core issue is trusting untrusted data, a common developer mistake with severe consequences.

CVE-2026-7567 — Temporary Login <= 1.0.0

Summary: An authentication bypass vulnerability in the “Temporary Login” plugin (versions <= 1.0.0) leading to account takeover. CVSS/Details: CVSS 9.8 (Critical). Published ~9 hours ago. PoC: Unclear. Marcus take:

“Temporary Login” sounds like a plugin designed for convenience, and convenience often comes at the cost of security. An authentication bypass in a login mechanism is as bad as it gets for a plugin. If you’re using this, or any similar “temporary access” plugin, assume it’s compromised. Disable it immediately, scan for backdoors, and revoke any temporary accounts. This is a common pattern: third-party plugins as the weakest link.

CVE-2026-22166 — Imagination Technologies Graphics DDK

Summary: A Write Use-After-Free (UAF) vulnerability in KEGLGetPoolBuffers within the Imagination Technologies Graphics DDK, reachable via WebGL. CVSS/Details: CVSS 9.6 (Critical). Published ~16 hours ago. PoC: Unclear. Marcus take:

A UAF in graphics drivers, especially one reachable via WebGL, is a potent vector for local privilege escalation or even remote code execution in specific contexts (e.g., browser sandboxes). While this might not be directly internet-facing for most, it’s a critical component in the client-side attack chain. This is a supply chain vulnerability for device manufacturers and a potential target for sophisticated attackers looking to break out of browser sandboxes. Update your graphics drivers if you’re an end-user, and if you’re a developer using this DDK, prepare for a patch.

CVE-2026-34197 — Apache ActiveMQ Classic

Summary: An improper input validation and code injection vulnerability in Apache ActiveMQ Classic. Although published last month, it’s trending now, indicating increased attacker interest and likely exploitation attempts. CVSS/Details: CVSS 8.8 (High). Published last month, trending now. PoC: Unclear. Marcus take:

Apache ActiveMQ Classic is a workhorse in many enterprise environments for messaging. An 8.8 CVSS for input validation and code injection is a serious issue, often leading to RCE or data manipulation. The fact that it’s trending now, weeks after disclosure, means attackers have likely had time to weaponize it. If you’re running ActiveMQ, this needs to be on your radar for immediate patching. Don’t wait for a confirmed PoC; assume it exists and is being used.

⚡ TTPs & Attack Research — Deep Dives

No new TTPs or attack research were identified in the provided intelligence briefing for this period.

🏗️ DevSecOps & Cloud

No specific DevSecOps or Cloud Security news items were identified in the provided intelligence briefing for this period.

🔧 Patches — Honest Assessments

No specific patch assessments were identified in the provided intelligence briefing for this period.

🧪 Threat Intel — Campaign Analysis

Ransomware groups continue their relentless assault, demonstrating consistent activity and a broad targeting scope over the weekend. The sheer volume of new victims reported by multiple intelligence sources paints a grim picture of the current threat landscape.

Ransomware Activity Overview: Multiple intelligence sources, including PurpleOps, StealthMole, and Ransom-DB, reported a significant number of new ransomware victims in the last 24-48 hours. PurpleOps noted 13 new victims, with Qilin leading the charge, targeting technology, financial technology, and construction sectors across the US, Canada, and Germany. StealthMole reported 15 new victims, highlighting THE GENTLEMAN, Akira, and Brain groups as particularly active. Ransom-DB, with the highest count, documented 45 new attacks.

Notable Incidents:

• SLSH Ransomware: This group notably hit Cushman & Wakefield Inc., a global real estate services firm, and Instructure Holdings Inc. (Canva LMS), a prominent educational technology company. The targeting of an education platform is particularly concerning, as it often involves sensitive student and faculty data.
• M3RXDLS Ransomware: This group claimed a breach against Emtco.com.
• Other Active Groups: Qilin, THE GENTLEMAN, Akira, Brain, DragonForce, Audit, and M3RXDLS were all actively posting new victims, indicating a diverse and persistent threat.

Attribution and Geopolitical Context: While specific geopolitical attribution for these individual attacks is not provided, the consistent targeting across Western economies (US, Canada, Germany) by a variety of groups points to financially motivated cybercrime. The use of Linux encryptors, as seen with the “Sorry” ransomware, is a growing trend, indicating threat actors are adapting their tooling to target server-side infrastructure more effectively. The rapid operationalization of newly disclosed vulnerabilities, such as the cPanel flaw, underscores the agility of these groups and the need for immediate patching.

IOCs: Specific IOCs for these broader campaigns are not publicly detailed in the briefing, beyond the .sorry extension for the “Sorry” ransomware. However, for any organization that finds itself a victim, immediate forensic analysis to identify specific malware hashes, C2 infrastructure, and persistence mechanisms is paramount.

🌐 Industry & Brand Security

*No specific Industry, Brand & Internet Security news items were identified in the