Same message ;(
I think it’s possible, but it could take lots of effort. I am restoring from 10/22, and see how to protect it
1 Like
I have to restore from 1 month old snapshot 
But I have a daily backup with synology backup for business
habe to manage to get all files back in place.
Does anyone have any idea when the attacks were launched?
1 Like
all file hacker encripted by .locked format. how restore it ? please help.
1 Like
I have updated the first comments. If you have problems at any step, please reply here
After 24H I found no other problems
If the CPU is running above 100% you need to boot through the service provider’s control panel
If there is no solution I think you have to restore from backup and upgrade cyberpanel
As many of you know, we resolved the issue a few days ago; however, some servers may still be experiencing problems. If you are encountering any issues, please contact our support team. If you have SSH access, please update first and then check for any remaining issues. Let us know if further assistance is needed—we have already resolved issues for many users, and our support team is actively working to assist you.
For support, reach us at: [email protected].
Please also review this blog post for additional details and a fix: Details and Fix of Recent Security Issue and Patch for CyberPanel.
1 Like
I cant access cyberpanel. Is there any fix? Also dont have backups on Hetzner cloud. Did cyberpanel have any backup? Please help me to get access to cyberpanel.
This is a RCE “remote code execution” vulnerability, it can install a miner, but also place and prepare encryptions scripts, which will start, if you only kill the miner!
With a RCE you can do everything you want!
0-click pre-auth root RCE
At first only a miner was installed, after I had killed the miner and removed the services, a other process triggered after I was idle for some time and started a bash3 process, which encrypted all files!
@DavidChriss looks like your server is already encrypted and therefore will not start anymore.
The Script encrypts everything even system files.
As soon as the server is then restarted, it won’t boot, since every file is encrypted.
Only a Backup can restore your files.
@skym4n have a look at
and
As I checked yes I found my files are encrypted by .encrypt
And I think this might be the solution to my problem
But I cant find any guide how to use it… any guide @bcat95 ?
Funny: The Blogpost mentions the following!
NOTE: We’re not sharing the exact location of the vulnerability to avoid exposing servers that still need updating.
NOTE: We’ll share the full details of the vulnerability.
It is already public since 27 Oct and you did know it since 23 Oct!
And it is already public as CVE-2024-51567, CVE-2024-51568 and CVE-2024-51378.
In every CVE there is the Link to the exploit, which was posted by DreyAnd.
Why are you lying in your Blogpost?!
Few Days Ago = Yesterday
Lol
we resolved the issue a few days ago
2 Likes
How can I fix my issue I cant acess to SSH and when I use VNC I found files locked and Cant upgrade cyberpanel as it seems like no network connection to the server it like the virus locked system files too
Most System file system are missing on my Side including /bin/bash network settings… creating them not helping… since is a lot of system files… what should I do now? Thanks
Why were users not informed, and the vulnerability published on responsible disclosure?
Not to mention any communication of the RCE vulnerability?!
Only after a great deal of damage was done to many users did you consider it necessary to publish a reference to a non-existent blog post only on facebook.
The blog is paved with so many posts that such messages, if any, are completely lost.
When I searched for security, countless posts came up that had nothing at all to do with the current problem!
Only after the update of Oct 29, a post appears.
2 Likes
I do have the same problem. There is a decryptor script published
In my case it doesn’t work because the files are locked at this time.
Any update?
1 Like
I dont know suffering trying to restore it…
Waiting for anyone who know what to do to help us
1 Like