Bluehost: CVE-2026-41940: Compromise Check Guide

CVE-2026-41940 is a critical vulnerability in cPanel/WHM that may allow unauthenticated attackers to gain administrative (root-level) access to affected servers. Public reporting confirms active exploitation and associated "Sorry" ransomware activity. This guide provides commands to check for known indicators of compromise (IOCs). These checks are not exhaustive. Attackers may delete logs, alter timestamps, remove files, replace binaries, or use tooling not covered here.

Step 1: Check Your cPanel Version

Run the following command to check your installed cPanel version:

/usr/local/cpanel/cpanel -V

Follow the steps in the Upgrade to Latest Version article to upgrade to the latest version.

Step 2: Set Up Check Directory

Run these commands as root to create a working directory for your checks:

mkdir -p /root/cpanel-cve-2026-41940-checks
cd /root/cpanel-cve-2026-41940-checks

Step 3: Run Compromise Checks

Run each check below in order. Any positive result should be treated as a potential full-server compromise.

Check 1: Look for "Sorry" Ransomware Marker Files

This searches common directories for files ending in .sorry, a known indicator of "Sorry" ransomware activity.

HOST="$(hostname -f 2>/dev/null || hostname)"

find /etc /root /usr/local/cpanel /home /var/lib/mysql /var \
  \( -path /proc -o -path /sys -o -path /dev -o -path /run \) -prune -o \
  -type f -name '*.sorry' \
  -printf "$HOST possible-ransomware-marker %p\n" 2>/dev/null

Check 2: Look for Known Malicious Process Hash

This calculates SHA1 hashes of all currently running process executables and checks for a known malicious binary.

HOST="$(hostname -f 2>/dev/null || hostname)"
BAD_SHA1="731572b5fe2a7ac6905527a237af4f59de8f7253"

for exe in /proc/[0-9]*/exe; do
  HASH="$(sha1sum "$exe" 2>/dev/null | awk '{print $1}')"
  if [ "$HASH" = "$BAD_SHA1" ]; then
    PID="$(echo "$exe" | cut -d/ -f3)"
    CMD="$(tr '\0' ' ' < "/proc/$PID/cmdline" 2>/dev/null)"
    echo "$HOST malicious-process-hash pid=$PID exe=$exe cmdline=$CMD"
  fi
done

Check 3: Check for Suspicious /root/.bashrc Injection

Attackers sometimes modify shell startup files to reload malware, hide commands, alter PATH, or maintain persistence. This check looks for a known suspicious string and common malicious patterns.

Basic Check

HOST="$(hostname -f 2>/dev/null || hostname)"

grep -Fq '0xa59ac734' /root/.bashrc 2>/dev/null \
  && echo "$HOST found-root-bashrc-injection /root/.bashrc contains 0xa59ac734"

Expanded Check (Recommended)

HOST="$(hostname -f 2>/dev/null || hostname)"

grep -RInE '0xa59ac734|curl |wget |base64|/dev/tcp|nohup|setsid|nc |ncat|socat|bash -i|python.*socket|perl.*socket' \
  /root/.bashrc /root/.bash_profile /root/.profile /etc/profile /etc/bashrc /etc/profile.d 2>/dev/null \
  | sed "s/^/$HOST suspicious-shell-startup /"

Check 4: Review Root SSH Authorized Keys

This checks whether the root SSH authorized_keys file was modified after the vulnerability was first publicly reported (2026-04-28), and prints current keys for manual review. 

Check for Recent Modifications

HOST="$(hostname -f 2>/dev/null || hostname)"
SINCE="2026-02-23"

find /root/.ssh/authorized_keys -type f -newermt "$SINCE" \
  -printf "$HOST root-authorized-keys-modified %TY-%Tm-%Td %TH:%TM:%TS %p\n" 2>/dev/null

Print Current Keys for Manual Review

HOST="$(hostname -f 2>/dev/null || hostname)"

stat /root/.ssh/authorized_keys 2>/dev/null | sed "s/^/$HOST authorized_keys_stat /"
nl -ba /root/.ssh/authorized_keys 2>/dev/null | sed "s/^/$HOST authorized_keys_line /"

Check 5: Check cPanel Template for Credential Stealer

This checks whether cPanel's main login template has been modified to inject JavaScript that could steal credentials or session data.

HOST="$(hostname -f 2>/dev/null || hostname)"
FILE="/usr/local/cpanel/base/unprotected/cpanel/main.tmpl"

grep -nE 'XMLHttpRequest|fetch\(|document\.cookie|localStorage|navigator\.sendBeacon|atob\(|eval\(' "$FILE" 2>/dev/null \
  | sed "s/^/$HOST suspicious-cpanel-template $FILE:/"

Check 6: Review Shell History for Suspicious Activity

Some confirmed compromises have included destructive cleanup, encryption, and persistence commands in shell history.

HOST="$(hostname -f 2>/dev/null || hostname)"

for hist in /root/.*history /home/*/.*history; do
  [ -f "$hist" ] || continue
  grep -HnEi 'nuclear|\.sorry|encrypt|ransom|authorized_keys|main\.tmpl|XMLHttpRequest|curl |wget |chmod \+x|base64|nohup|setsid|rm -rf|shred|wipe|chattr|iptables|firewall-cmd|systemctl disable|history -c' "$hist" 2>/dev/null \
    | sed "s/^/$HOST suspicious-history /"
done

What to Do If Any Check Returns a Positive Result

Recommended immediate actions:

1. Do not continue using the server for production traffic until it has been reviewed or rebuilt.
2. Contact Bluehost Support immediately for assistance.
3. Preserve evidence — take snapshots or disk images before making changes.
4. Review all hosted accounts for signs of compromise or unauthorized changes.
5. Rotate all credentials, SSH keys, API keys, and passwords that may have been accessible on the server.
6. Notify affected customers if customer data may have been exposed.

Limitations of These Checks

These checks do not replace:

• Forensic review by a security professional
• Endpoint detection and response (EDR) tools
• File integrity monitoring
• Full log analysis
• Rebuilding from trusted, clean media