🚨 BREAKING: Hackers are now exploiting the cPanel authentication bypass flaw (CVE-2026-41940) to deploy "Sorry" ransomware on compromised websites.
Numerous sources say attacks began Thursday, with threat actors breaching servers and deploying a Go-based Linux encryptor that appends the .sorry extension to files.
What the ransomware does:
🔴 Encrypts files and appends the ".sorry" extension.
🔴 Protects the encryption key with an embedded RSA-2048 public key
🔴 Drops a README.md ransom note in every folder
🔴 Uses a fixed Tox ID for ransom negotiations
Victims are being instructed to contact the attacker via Tox to pay for decryption.
This is not related to the older 2018 HiddenTear ".sorry" ransomware. This is a new, Linux-targeting encryptor tied directly to active cPanel exploitation.
If you're running cPanel or WHM, patch immediately.
Let me blow your mind real quick:
When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.
💀
@d0nutptr This would give me anxiety AF, I remove notification s if it is an option and for email, periodically make rules to Archive or skip inbox XD It is still there, unread, but no pop up about it.
You've probably seen this SQL Injection payload before... 🧐
But how does it exactly work?
Let's break it down and also craft a few variants for bypassing WAFs! 🤑👇
Fun with Joomla CVE-2023–23752 vulnerability and priv escalation (CVE-2023–1326) in apport-cli < 2.26.0 https://t.co/AOU9DfYXpJ #hackthebox#htb#cybersecurity
New issue of Executive Offense!
"Mobile Hacking Part 2" in which I have an exclusive interview with @0xteknogeek on methodology++
This one is JAM PACKED. imo a must read. (subscribe to see the video, otherwise it doesnt show up)
https://t.co/RFjiobn2me
A few tests later and you've noticed that the following bypasses all worked as well:
You were surprised because you thought it validated your input by parsing the domain
Instead, it was just a loosely-scoped regex that allowed you to get the SSO token
OWASP Amass v4.2 has been released with removal of the db subcommand. Typical #bugbounty usage looking like the following:
amass enum -d https://t.co/9iBNQ5A4ju
oam_subs -names -d https://t.co/9iBNQ5A4ju > subs.txt
https://t.co/S7BuD8bZJ7
#owasp#osint#recon#attacksurface
OR 1=1 should not be the go-to example for SQL injection. I understand why it is, but using it without mentioning the risks is teaching bad practice.
OWASP, Portswigger, Wikipedia, Rapid7, Snyk etc. are all doing it.
I'm gonna die on this hill. 🤬
AI helps greatly translating JavaScript to "Human Readable Language", here's how I found a very straight forward DOM Based XSS in 2 minutes.
#BugBounty