44,000 Websites Just Got Hit With Ransomware — Is Yours Next?
A critical security vulnerability in one of the internet’s most widely used web hosting platforms is being actively weaponized right now — and the numbers are alarming. As of this weekend, over 44,000 servers running cPanel and WHM have been compromised in a sweeping ransomware campaign security researchers are calling “Sorry.”
If your business has a website — and in 2026, that means virtually every business — this story matters to you.
What Happened
On April 28, 2026, cPanel released an emergency security patch for a critical authentication bypass flaw tracked as CVE-2026-41940. cPanel is the Linux-based web hosting control panel used by millions of websites worldwide to manage their hosting environment, databases, email accounts, and site files. WHM (Web Host Manager) sits on top of it, giving server administrators full control over entire hosting environments.
The flaw allows attackers to completely bypass authentication and gain administrator-level access to a server — no username, no password required. Exploitation of this vulnerability actually began back in late February as a zero-day, meaning attackers were quietly taking advantage of it weeks before a fix even existed.
Since the patch was released and the vulnerability became public knowledge, the internet watchdog organization Shadowserver reports that attack activity has surged dramatically. Hackers are now deploying a Go-based Linux encryptor that appends the .sorry extension to every file it touches — rendering websites, databases, and stored customer data completely inaccessible.
The encryption uses the ChaCha20 stream cipher protected by an embedded RSA-2048 public key. According to ransomware researchers, decryption without the attacker’s private key is mathematically impossible. Hundreds of compromised sites have already been indexed by Google, with victims reporting ransom notes demanding payment via the Tox encrypted messaging platform.
What This Means for NYC Small Businesses
You might think ransomware is a problem for big corporations with enterprise IT departments — but this attack is specifically targeting web hosting infrastructure. That hits small and mid-sized businesses disproportionately hard.
Here’s why this is especially dangerous for local NYC businesses:
- Your website could go dark overnight. If your hosting provider hasn’t patched CVE-2026-41940, attackers can lock your entire site — taking down your storefront, booking system, or client portal with it.
- Customer data could be exposed or destroyed. Attackers often exfiltrate data before encrypting it. Contact forms, order databases, and stored client information are all at risk.
- Recovery without backups is nearly impossible. Because the encryption is cryptographically unbreakable, victims who haven’t maintained clean, recent backups face a brutal choice: pay the ransom or rebuild from scratch.
- The attack is still accelerating. Security researchers warn that exploitation will continue to increase over the coming days and weeks as more attackers pile on.
This isn’t theoretical risk. The websites of hundreds of businesses — restaurants, law firms, medical practices, contractors — are being locked right now. Any business running an unpatched cPanel server is actively in the crosshairs.
How to Protect Your Business
Here’s the good news: this attack is entirely preventable with the right security posture. Here’s what every business owner should verify immediately:
1. Make Sure Your Hosting Is Patched
If your website runs on cPanel or WHM, your hosting provider must have applied the CVE-2026-41940 emergency patch released April 28, 2026. Contact your host and ask directly: “Have you patched CVE-2026-41940?” If they can’t confirm, it’s time to have a serious conversation — or find a new provider.
At MicroSky Managed Services, we proactively monitor for critical vulnerabilities and apply security patches to the hosting environments we manage. Our clients didn’t have to lift a finger on this one — we had it covered.
2. Audit Your Backups Right Now
Ransomware’s leverage over you is simple: if it encrypts your data and you have no backup, you’re stuck. The “Sorry” ransomware campaign is a brutal reminder that cloud backup isn’t optional — it’s your last line of defense.
MicroSky’s Cloud Backup & Disaster Recovery solutions keep clean, versioned copies of your data safely offsite. Even if ransomware locks your servers tonight, you can restore from yesterday’s backup and be back online without paying a single cent in ransom.
3. Harden Your Web Hosting Environment
Authentication bypass vulnerabilities like this one thrive in environments where security hygiene is lax. Strong access controls, multi-factor authentication, and routine security audits dramatically shrink your attack surface. MicroSky’s Managed IT and Cybersecurity services include ongoing monitoring and hardening of your entire tech stack — not just reactive fixes when something breaks.
4. Deploy Endpoint and Network Protection
Even if ransomware gets past your website, robust EDR (Endpoint Detection & Response) and a managed SOC can catch and contain it before it spreads. MicroSky’s cybersecurity stack combines cutting-edge endpoint protection with 24/7 threat monitoring, so threats are stopped before they become disasters.
5. Consider Managed Website Hosting
The safest place for your website is with a provider that treats security as a core service — not an afterthought. MicroSky’s Website Hosting & Design plans include active security management, so vulnerabilities like CVE-2026-41940 get patched before attackers can exploit them.
The Bottom Line
The “Sorry” ransomware campaign is a textbook example of why reactive security doesn’t work. By the time a vulnerability is public knowledge, attackers are already exploiting it at scale. 44,000 compromised servers in a matter of days. The businesses that weather events like this are the ones that invested in proactive protection before the attack arrived.
Don’t wait for a ransom note to take security seriously.
Is Your Business Protected? Let’s Find Out.
MicroSky Managed Services has been protecting NYC businesses for over 20 years. From managed IT and cybersecurity to cloud backup, website hosting, and 24/7 emergency support — we’re built to keep your business running no matter what attackers throw at it.
👉 Visit microskyms.com to learn about our services, or call us at (718) 672-2177 to talk to a real person about securing your business today.
Not sure if your current hosting or IT setup is vulnerable? Ask us for a free security review. We’ll take a look and tell you exactly where you stand.