Michaela Stranovská

Posts and views are my own

[BleepingComputer @BleepinComputer]

🚨 BREAKING: Hackers are now exploiting the cPanel authentication bypass flaw (CVE-2026-41940) to deploy "Sorry" ransomware on compromised websites.

Numerous sources say attacks began Thursday, with threat actors breaching servers and deploying a Go-based Linux encryptor that appends the .sorry extension to files.

What the ransomware does:

🔴 Encrypts files and appends the ".sorry" extension.
🔴 Protects the encryption key with an embedded RSA-2048 public key
🔴 Drops a README.md ransom note in every folder
🔴 Uses a fixed Tox ID for ransom negotiations

Victims are being instructed to contact the attacker via Tox to pay for decryption.

This is not related to the older 2018 HiddenTear ".sorry" ransomware. This is a new, Linux-targeting encryptor tied directly to active cPanel exploitation.

If you're running cPanel or WHM, patch immediately.

[Justin Elze @HackingLZ]

CISOs should consider taking 30 minutes and reading a few random reports from @TheDFIRReport

https://t.co/IsUG5tv2Q2

[IT Guy @T3chFalcon]

Let me blow your mind real quick:

When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.

It’s called the RDP Bitmap Cache.

To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.

Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.

Forensics teams use tools like BMCViewer to stitch those tiles back together.

They won't just see logs but the literal email, document, or picture you were looking at.

💀

[Michaela Stranovská @Michelle_Stran]

@d0nutptr This would give me anxiety AF, I remove notification s if it is an option and for email, periodically make rules to Archive or skip inbox XD It is still there, unread, but no pop up about it.

[Michaela Stranovská @Michelle_Stran]

@Bugcrowd

[Intigriti @intigriti]

You've probably seen this SQL Injection payload before... 🧐

But how does it exactly work?

Let's break it down and also craft a few variants for bypassing WAFs! 🤑👇

[Michaela Stranovská @Michelle_Stran]

Yep, https://t.co/U2dSXAZkqT tools are awesome. Here's a Guide created on how to implement Nuclei into your CI/CD pipeline! https://t.co/3815rjY2CK

[ProjectDiscovery @pdiscoveryio]

If you're looking to take your @pdnuclei skills to the next level, we have the ultimate guide for you! Level up: https://t.co/jzBHJofogB

[picoCTF @picoctf]

🚀 picoCTF 2024 Has Officially Started! 🎉
The wait is over – picoCTF 2024 is underway! @CarnegieMellon @TCMSecurity @crl_official @CyLabAfrica @CyLab https://t.co/BYRHyel0nx

[Nicolas Krassas @Dinosn]

CVE-2024-21378 — Remote Code Execution in Microsoft Outlook https://t.co/usVxdegKJw

[Michaela Stranovská @Michelle_Stran]

@thegamerzden19 @JezCorden Could be reasoned that some people take it as pure bloatware, instead the programs they want to use. 🤷‍♀️

[Michaela Stranovská @Michelle_Stran]

Fun with Joomla CVE-2023–23752 vulnerability and priv escalation (CVE-2023–1326) in apport-cli < 2.26.0 https://t.co/AOU9DfYXpJ #hackthebox #htb #cybersecurity

[@ddǝɐuɐp @DanaEpp]

Let me show you how to leverage curlconverter to write API exploits in Python using payloads generated in Burp Suite.

https://t.co/gaYFEHuURU

[JS0N Haddix @Jhaddix]

New issue of Executive Offense!

"Mobile Hacking Part 2" in which I have an exclusive interview with @0xteknogeek on methodology++

This one is JAM PACKED. imo a must read. (subscribe to see the video, otherwise it doesnt show up)

https://t.co/RFjiobn2me

[Linus ✦ Ekenstam @LinusEkenstam]

Woah. Wtf.

All anchors in this 21min news clip and numerous other things are AI powered.

Holy smokes, things are going to get wild

[Intigriti @intigriti]

A few tests later and you've noticed that the following bypasses all worked as well:

You were surprised because you thought it validated your input by parsing the domain

Instead, it was just a loosely-scoped regex that allowed you to get the SSO token

[OWASP Amass @owaspamass]

OWASP Amass v4.2 has been released with removal of the db subcommand. Typical #bugbounty usage looking like the following:

amass enum -d https://t.co/9iBNQ5A4ju

oam_subs -names -d https://t.co/9iBNQ5A4ju > subs.txt

https://t.co/S7BuD8bZJ7

#owasp #osint #recon #attacksurface

[Rebane @rebane2001]

👀

[Tib3rius @0xTib3rius]

OR 1=1 should not be the go-to example for SQL injection. I understand why it is, but using it without mentioning the risks is teaching bad practice.

OWASP, Portswigger, Wikipedia, Rapid7, Snyk etc. are all doing it.

I'm gonna die on this hill. 🤬

[Nagli @galnagli]

AI helps greatly translating JavaScript to "Human Readable Language", here's how I found a very straight forward DOM Based XSS in 2 minutes.

#BugBounty