cPanel IOC Detector for CVE-2026-41940

Read-only IOC detector for cPanel/WHM servers that may have been affected by CVE-2026-41940 and related post-compromise activity.

The script helps an operator review .sorry ransomware indicators, Mr_Rot13 Filemanager backdoor traces, suspicious cron entries, SSH key changes, callback traces, and cPanel log anomalies.

Start Here

Ping7 resources

• All GitHub tools: https://ping7.cc/github-tools/
• Full self-check guide: https://ping7.cc/guides/cpanel-cve-2026-41940-self-check/
• CVE repair service: https://ping7.cc/cve-repair/
• Sample repair report: https://ping7.cc/cve-repair/sample-report/
• Live CVE alerts: https://t.me/ping7cve

Issue or repair

Open a GitHub issue when the detector crashes, gives an unclear result, flags a false positive, or needs documentation cleanup. Keep the example non-sensitive.

Use Ping7 repair when the result is SUSPICIOUS or COMPROMISED, or when the evidence includes live domains, customer files, private logs, SSH keys, cron entries, or ransomware traces that should not be posted in public.

Evidence to keep

• Detector output and version.
• WHM/cPanel version and OS family.
• First suspicious timestamp.
• Ransomware extension examples, sanitized if needed.
• Unknown SSH keys, cron jobs, web-root paths, or cPanel session anomalies.
• Whether Apache, ModSecurity, cphulkd, and root login logs are still available.

Use This Repo When

• You operate the cPanel/WHM server or have explicit approval to review it.
• The server was patched late or the patch window was not documented.
• A customer reported redirects, encrypted files, changed web roots, or unknown admin activity.
• You need a terminal result that can be pasted into an incident ticket.
• You want a first pass before paying for cleanup or compromise review.

Quick Start

Inspect first:

curl -fsSLO https://raw.githubusercontent.com/limo57640-crypto/cpanel-cve-41940-detector/main/detect.sh
less detect.sh
sudo bash detect.sh

Do not run remote shell content straight into root. Download the script, review it, then run it on the server you are responsible for.

When To Run It

Run this on a cPanel/WHM server when:

• The server was patched late after CVE-2026-41940.
• .sorry or other unexpected encrypted file extensions appear.
• A hosting customer reported redirects, webshells, or changed files.
• WHM logins, SSH keys, cron entries, or public web roots changed unexpectedly.
• You need a fast first pass before a deeper compromise review.

What It Checks

Output

• CLEAN: no obvious IOC match.
• SUSPICIOUS: anomaly found, manual review needed.
• COMPROMISED: strong IOC match, immediate action required.
• ERROR: missing access, missing cPanel, or another runtime issue.

Sample Output

cPanel CVE-2026-41940 IOC Detector

Checks run:     12
Suspicious:     2
Compromised:    0

STATUS: SUSPICIOUS - INVESTIGATE FURTHER
Review cPanel sessions, cron entries, SSH keys, and web-root changes.
Guide: https://ping7.cc/guides/cpanel-cve-2026-41940-self-check

Exit Codes

Limitations

• It cannot prove a server was never compromised.
• It only checks files, logs, and runtime state available on the current host.
• Rotated logs, deleted files, mounted backups, or provider restrictions can hide useful evidence.
• Known IOC checks age quickly. Re-check the repository when new cPanel incident data appears.

Repair Handoff

If the result is SUSPICIOUS or COMPROMISED, keep the output and send:

Domain or server:
WHM/cPanel version:
CVE: CVE-2026-41940
Detector result: CLEAN / SUSPICIOUS / COMPROMISED / ERROR
First suspicious timestamp:
Symptoms: ransomware extension, unknown admin, redirect, SSH key, cron, webshell, or log anomaly
Logs still available: yes / no

Do not send passwords in the first message. Send symptoms, timestamps, screenshots, and sanitized log snippets.

Why Patching Is Not Enough

If the server was exposed during the active exploitation window, attackers may have added persistence that survives a cPanel update. This tool focuses on residue and post-compromise indicators.

What To Do If It Finds Something

1. Preserve logs and suspicious files before cleanup.
2. Snapshot the server if possible.
3. Rotate WHM, SSH, database, and customer passwords.
4. Remove persistence only after recording evidence.
5. Re-run the detector after cleanup.

Need repair help: https://ping7.cc/cve-repair

Contributing

Open an issue for a false positive, a missed defensive signal, or a new safe IOC source. Include cPanel build, OS family, detector version, and sanitized output. Do not post customer data, secrets, live attacker infrastructure, or attack strings.

Defensive Scope

This project is defensive only. Run it only on systems you own or are authorized to audit.

No payloads. No broad scanning. No exploitation steps.

License

MIT