The recent cPanel / WHM security issue (CVE-2026-41940) created serious problems for many server owners. In several cases, attackers were able to access vulnerable WHM servers, gain high-level privileges, and damage hosted accounts.
Some affected users reported their website files being encrypted or renamed, similar to past ransomware-style attacks.
One common example was:
wp-config.php
changed into:
wp-config.php.sorry
This type of .sorry extension was seen on important files, making websites stop working immediately.
What To Do First If Your Server Is Affected
If your WHM/cPanel server has already been attacked:
1. Take the Server Offline or Restrict Access
Immediately block public access to WHM/cPanel ports and SSH if suspicious activity is ongoing.
2. Do Not Trust the Existing System
If root access was compromised, the safest option is usually:
- Reinstall the server OS
- Reinstall cPanel / WHM
- Apply all security updates
- Change all passwords
Best Recovery Method: Restore From External Backup
Many people were able to recover quickly because they had backups stored outside the server.
Examples:
- Google Drive (GDrive)
- Remote backup server
- Object storage
- NAS in another location
If you have clean backups in Google Drive, recovery becomes much easier:
Recovery Process
- Fresh reinstall the server
- Install cPanel / WHM again
- Secure the server and patch vulnerabilities
- Download backups from GDrive
- Restore cPanel accounts / website data
- Test websites and email services
Why Local Backups Are Not Enough
If backups are stored on the same compromised server, attackers may encrypt or delete them too.
That is why offsite backups such as Google Drive can save your business.
How to Protect Your Server Now
Update cPanel Immediately
Make sure your cPanel version includes the security fix.
Use Offsite Automated Backups
At least daily backups to:
- Google Drive
- Remote storage
- Another VPS
Restrict WHM Access
Whitelist your IP for:
- 2087 (WHM)
- 2083 (cPanel)
Use Strong Passwords + 2FA
Especially for root, reseller, and admin accounts.
Final Advice
If your server was compromised, trying to “clean” it may not be enough. A full reinstallation + restore from clean Google Drive backup is often the safest and fastest route.
Need Help With cPanel Recovery?
I help with:
- cPanel hacked server recovery
- Malware cleanup
- WHM security hardening
- Backup restore from Google Drive
- Server migration
- Performance & troubleshooting
Contact me through this website.