Sorry

Reported Context (4)

exploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strain called Sorry. LiteSpeed Says CVE-2026-48172 in cPanel Plugin Is Actively Exploited to Run Scripts as Root
should update to 110.0.114 while noting that CVE-2026-41940 was recently weaponized to deploy Mirai and Sorry. cPanel and WHM Patch Three Flaws Enabling Code Execution and Possible Privilege Escalation
Other attacks have deployed Mirai botnet variants and a ransomware strain called Sorry. Weekly Cybersecurity Recap: Active cPanel and Linux Exploits, Supply-Chain Attacks and New Malware
A critical authentication bypass in WHM and cPanel (CVE-2026-41940) is being mass-exploited to breach servers and deploy a Linux encryptor used in “Sorry” ransomware attacks. CVE-2026-41940 cPanel Flaw Exploited in Sorry Ransomware Attacks

CVE (9)

Malware (7)

People (3)

Threat Actors (9)

MITRE ATT&CK (17)

Vendors (7)

Products (11)

Tools (3)

Industries (9)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.