BleepingComputer

37.3K posts

BleepingComputer banner
BleepingComputer

BleepingComputer

@BleepinComputer

Breaking cybersecurity and technology news, guides, and tutorials that help you get the most from your computer. DMs are open, so send us those tips!

New York Katılım Haziran 2009
206 Takip Edilen252.2K Takipçiler
BleepingComputer
BleepingComputer@BleepinComputer·
🚨 BREAKING: Hackers are now exploiting the cPanel authentication bypass flaw (CVE-2026-41940) to deploy "Sorry" ransomware on compromised websites. Numerous sources say attacks began Thursday, with threat actors breaching servers and deploying a Go-based Linux encryptor that appends the .sorry extension to files. What the ransomware does: 🔴 Encrypts files and appends the ".sorry" extension. 🔴 Protects the encryption key with an embedded RSA-2048 public key 🔴 Drops a README.md ransom note in every folder 🔴 Uses a fixed Tox ID for ransom negotiations Victims are being instructed to contact the attacker via Tox to pay for decryption. This is not related to the older 2018 HiddenTear ".sorry" ransomware. This is a new, Linux-targeting encryptor tied directly to active cPanel exploitation. If you're running cPanel or WHM, patch immediately.
BleepingComputer tweet mediaBleepingComputer tweet media
English
15
229
812
99.8K
BleepingComputer
BleepingComputer@BleepinComputer·
@SquiblydooBlog Microsoft has confirmed to BleepingComputer that these false positives were introduced when they added detections for certificates compromised in the recent DigiCert breach.
English
1
5
20
4K
BleepingComputer
BleepingComputer@BleepinComputer·
More from @SquiblydooBlog regarding how recently compromised DigiCert certificates were likely abused in malware campaigns: x.com/SquiblydooBlog…
Squiblydoo@SquiblydooBlog

We didn't know how an actor was using EV Certificates issued to Lenovo and others. We now do. From DigiCert's incident report: "the threat actor used a compromised analyst endpoint to access DigiCert's internal support portal. The threat actor used a limited function within the customer-support portal which allows authenticated DigiCert support analysts to access customer accounts from the customer's perspective to facilitate support tasks. The threat actor was able to use this function to access initialization codes for orders that were approved but pending delivery for EV Code Signing certificate orders across a finite set of customer accounts." "Possession of the initialization code, combined with an approved order, is functionally sufficient to generate and retrieve the corresponding certificate." The full report can be found here and explains the incident in great detail: bugzilla.mozilla.org/show_bug.cgi?i… The report mentions "Where we got lucky: A community member involved in security research reported the evolving pattern of misused certificates and engaged in dialogue with our support team. Without that report, the undetected compromise of ENDPOINT2 and the associated mis-issuance might have remained undiscovered for a longer period." Special thanks goes to the regular contributors to the Cert Graveyard; @g0njxa , @malwrhunterteam , and others. Also special thanks to DigiCert: this report has a high level of transparency, which is warranted, and also well executed.

English
1
4
33
13.3K
BleepingComputer
BleepingComputer@BleepinComputer·
🚨 Warning: Microsoft Defender is wrongly flagging some DigiCert certificates as Trojan:Win32/Cerdigent.A!dha, triggering widespread false positives on Windows systems. Admins report certificates being removed from the Windows trust store after recent Defender signature updates. What’s happening: 🔴 Two DigiCert root certificates flagged as malware 🔴 Some systems remove certs from the AuthRoot trust store 🔴 Detection added in April 30th Defender signature updates Microsoft has released fixes in Security Intelligence updates version 1.449.430.0. The issue comes shortly after a DigiCert breach where attackers gained access to support systems and code-signing certificates. If you're seeing Trojan:Win32/Cerdigent.A!dha alerts, update Defender signatures immediately.
English
12
192
605
78K

Keşfet

@flaresystems @SquiblydooBlog @elonmusk @BarackObama @taylorswift13 @cristiano @BillGates @NASA