Security Posture Report - April 2026

Attack analysis

1. Weak password entry point: Attackers gain initial access by using weak passwords to log in to public-facing ERP/OA system login pages. They then use the system's built-in features to obtain command execution permissions.

2. N-day vulnerability entry point: Attackers exploit known vulnerabilities in public-facing ERP/OA systems to gain direct system access.

3. Stealthy payload delivery:

• Attackers download the ransomware from legitimate cloud storage services, such as Alibaba Cloud OSS, Tencent Cloud COS, and Amazon S3, to bypass network firewall detection.

• Attackers disguise malicious files with names that mimic legitimate system processes, such as gnsc.exe, GnServer.exe, to evade manual inspection and basic allowlist monitoring.

1. Encryption and ransom: The attacker executes the .sorry ransomware to encrypt server data and then demands a ransom.

IOCs

File Hashes (MD5)

• 6c3f7b06fc86f26635709e2e6f69a336

• f33eb258db1cefff9083305e14e1234b

Recommendations

1. Reduce public network exposure. Do not expose your application delivery platform to the public internet unless necessary. If you must expose it, restrict access by using an IP allowlist.

2. Immediately change all default or weak passwords. Use strong passwords that are at least 12 characters long and include a mix of uppercase letters, lowercase letters, numbers, and special characters.

3. Use modern, actively maintained versions of ERP/OA systems and avoid unsupported legacy versions. If you cannot upgrade for specific reasons, you must implement the foundational security hardening measures described in the first two recommendations.

Attack technique

1. Initial compromise: Attackers obtain a user's AccessKey (AK) by exploiting unauthorized access vulnerabilities, misconfigurations, or social engineering. They then use the stolen key to gain control over the ECS instances in the target account.

2. Backdoor installation: After gaining access, attackers remotely execute malicious commands or upload Trojan horse files to the compromised ECS instance. Because attackers use legitimate operational channels provided by the cloud platform, these actions are highly stealthy and can evade some traditional host-based security detection tools.

IOCs

File Hashes (MD5)

• 7c6799b6cee294f285286cafb8f0297b

• 83290d13bdda1fd0ba475b3287534d10

Recommendations

1. Respond to AK anomaly alerts promptly. If you receive an alert from Alibaba Cloud about unusual AccessKey (AK) activity or a protective restriction, immediately verify if the AK has been compromised. Review the relevant API call logs to detect and block suspicious operations, and check your hosts for any abnormal backdoors.

2. Remediate infected hosts quickly. If you confirm that a system has been compromised with a backdoor or have received a backdoor alert from Alibaba Cloud, you can claim your ECS Exclusive Free Security Protection. Then, navigate to the Alibaba Cloud Security Center and go to Protection Settings > Virus Scan to perform a comprehensive, in-depth scan of the server. This scan will identify and remove malicious programs, backdoor files, and persistence mechanisms.

cPanel/WHM authentication bypass vulnerability (CVE-2026-41940)

In April 2026, a critical authentication bypass vulnerability (CVSS 9.8) was disclosed in the popular Linux host control panel, cPanel/WHM. The vulnerability stems from the login process failing to validate certain request parameters and session states. This allows an attacker to craft a malicious request that bypasses username and password verification, directly marking their session as authenticated. An attacker can exploit this vulnerability without credentials or special permissions to take full control of the server, tamper with websites, or plant a backdoor. A proof-of-concept (PoC) has been publicly released, and the risk of in-the-wild exploitation is extremely high.

Affected versions:

cPanel & WHM

• 11.40 <= versions < 86.0.41

• 88.0.0 <= versions < 110.0.97

• 112.0.0 <= versions < 118.0.63

• 120.0.0 <= versions < 126.0.54

• 128.0.0 <= versions < 130.0.19

• 132.0.0 <= versions < 132.0.29

• 134.0.0 <= versions < 134.0.20

• 136.0.0 <= versions < 136.0.5

WP Squared versions < 136.1.7

Alibaba Cloud recommends that cPanel/WHM users take the following actions immediately:

1. Upgrade to a secure version: Update cPanel & WHM to the official secure versions or later (refer to the "Affected versions" section for details) to fully patch the vulnerability.

2. Reduce the attack surface: Do not expose cPanel/WHM management ports (commonly 2080, 2083, 2086, and 2087) to the public internet. Configure a security group or firewall rules to allow access only from trusted IP addresses.

Cockpit command injection vulnerability (CVE-2026-4631)

In April 2026, a medium-severity command injection vulnerability was disclosed in the Linux server management tool Cockpit. Its remote login feature directly passes user-provided hostnames and usernames to the underlying SSH client without proper validation or escaping. An attacker can craft a special HTTP request to inject malicious SSH options or shell commands and execute remote code on the host without valid credentials.

Affected versions: Versions before 344-2.el9_7

Alibaba Cloud recommends that users of Cockpit take the following actions immediately:

1. Upgrade your system: Update your current system or software to the latest version to patch the vulnerability.

2. Temporary mitigation: If you cannot upgrade immediately, restrict access to the Cockpit login endpoint to allow connections only from trusted internal IP addresses.

Apache ActiveMQ Jolokia code execution vulnerability (CVE-2026-34197)

In April 2026, a high-severity remote code execution vulnerability was disclosed in the open-source message middleware, Apache ActiveMQ. An attacker can exploit the Jolokia interface, which is enabled by default in the web console. By crafting a URL with malicious parameters, an attacker can trick the server into loading a remote malicious configuration file and executing arbitrary code. A successful exploit grants the attacker full control of the server, allowing them to install malicious programs or steal business data, which can severely impact services. A PoC script for this attack is publicly available, posing an extremely high risk.

Affected versions:

• Apache ActiveMQ < 5.19.4

• 6.0.0 <= Apache ActiveMQ < 6.2.3

Alibaba Cloud has sent security alerts to potentially affected users. If you received a notification, you must investigate and remediate the vulnerability as soon as possible. If you are using Apache ActiveMQ, we also recommend that you take the following actions immediately:

1. Upgrade version: Upgrade ActiveMQ to the latest official secure version.

2. Access control: Configure firewall or security group policies to ensure the ActiveMQ management console is open only to trusted internal IP addresses.

3. Password hardening: Change the default login password for the web console and avoid using weak passwords.

Linux kernel "Copy Fail" local privilege escalation vulnerability (CVE-2026-31431)

In April 2026, a high-severity local privilege escalation vulnerability (CVSS 8.7) was disclosed in the Linux kernel. The vulnerability, dubbed "Copy Fail," stems from a logical flaw in how the kernel's cryptographic module handles data copying. An attacker can exploit this copy error, in conjunction with specific system calls, to forcibly modify the memory of critical system authentication programs (such as the su command). This allows them to bypass permission checks and escalate from a standard user to the root superuser. Exploit code (EXP) is publicly available, and the cost of exploitation is extremely low.

Affected versions:

This vulnerability affects nearly all major Linux kernel versions built between 2017 and the release of the patch in April 2026 (commit a664bf3d603d). This includes long-term support (LTS) versions such as 4.14, 4.19, 5.4, 5.10, 5.15, 6.1, and 6.6, as well as specific kernel versions of distributions like Alibaba Cloud Linux, Anolis OS, CentOS, Ubuntu, and RedHat. (For more details, see the Alibaba Cloud bulletin.)

Alibaba Cloud recommends that users of a Linux server take the following actions immediately:

1. Upgrade the kernel (Recommended): Upgrade the Linux kernel to the latest patched version and restart the server to apply the changes.

2. Temporary mitigation: If you cannot restart the server immediately, disable the algif_aead kernel module to block the attack path. Note: Some distributions, such as CentOS 8.5, may have this module statically compiled into the kernel, making it impossible to unload. In such cases, you must fix the vulnerability by upgrading the kernel.

3. Container protection: For container environments, we recommend configuring a Seccomp policy to prohibit the creation of AF_ALG sockets (family=38) inside the container.

4. Precautionary note: Before making any kernel-level changes or disabling modules, you must back up critical data and create a system snapshot to prevent service disruptions.