All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Wordpress.org are hacked?
hezekiahshare
Member
Hello im downloading new update from https://wordpress.org/download/
and after extracting i got weird file "wp-includes/html-api/html5-named-character-references.php" and blocked by Antivirus it was from wordpress
This contains an Weird Codes:
"**
* Auto-generated class for looking up HTML named character references.
*
* ⚠️ !!! THIS ENTIRE FILE IS AUTOMATICALLY GENERATED !!! ⚠️
* Do not modify this file directly.
*
* To regenerate, run the generation script directly.
*
* Example:
*
* php tests/phpunit/data/html5-entities/generate-html5-named-character-references.php
*
* @package WordPress
* @since 6.6.0
*/
// phpcs:disable
global $html5_named_character_references;
/**
* Set of named character references in the HTML5 specification.
*
* This list will never change, according to the spec. Each named
* character reference is case-sensitive and the presence or absence
* of the semicolon is significant. Without the semicolon, the rules
* for an ambiguous ampersand govern whether the following text is
* to be interpreted as a character reference or not.
*
* The list of entities is sourced directly from the WHATWG server
* and cached in the test directory to avoid needing to download it
* every time this file is updated.
*
* @link https://html.spec.whatwg.org/entities.json.
*/
$html5_named_character_references = WP_Token_Map::from_precomputed_table(
array(
"storage_version" => "6.6.0-trunk",
"key_length" => 2,
"groups" => "AE\x00AM\x00Aa\x00Ab\x00Ac\x00Af\x00Ag\x00Al\x00Am\x00An\x00Ao\x00Ap\x00Ar\x00As\x00At\x00Au\x00Ba\x00Bc\x00Be\x00Bf\x00Bo\x00Br\x00Bs\x00Bu\x00CH\x00CO\x00Ca\x00Cc\x00Cd\x00Ce\x00Cf\x00Ch\x00Ci\x00Cl\x00Co\x00Cr\x00Cs\x00Cu\x00DD\x00DJ\x00DS\x00DZ\x00Da\x00Dc\x00De\x00Df\x00Di\x00Do\x00Ds\x00EN\x00ET\x00Ea\x00Ec\x00Ed\x00Ef\x00Eg\x00El\x00Em\x00Eo\x00Ep\x00Eq\x00Es\x00Et\x00Eu\x00Ex\x00Fc\x00Ff\x00Fi\x00Fo\x00Fs\x00GJ\x00GT\x00Ga\x00Gb\x00Gc\x00Gd\x00Gf\x00Gg\x00Go\x00Gr\x00Gs\x00Gt\x00HA\x00Ha\x00Hc\x00Hf\x00Hi\x00Ho\x00Hs\x00
Anyone experience this?
Comments
Unless their github was also hacked, seems to match a recent commit: https://github.com/WordPress/wordpress-develop/commit/bcd25b14ec0208657af1299b6df5642b5c0260a9
Yeah seemlike their website are down now i cant access it
No? Not getting flagged for anything on VT.
https://www.virustotal.com/gui/file/289011b5bb5bbd1b37c03b5ac0543460216f07a780c6b252540efffd19a55536/detection
https://www.virustotal.com/gui/file/2a3941baab9845abd796d5243dee4e2e4b6824c2bc6a4b9b9ebf8a71604275ec/detection
it was blocked from cpguard really thanks for them Imunify360 doesnt detect it
It just encrypted? or the file was hacked?
https://github.com/WordPress/WordPress/blob/master/wp-includes/html-api/html5-named-character-references.php
blocked by CPGuard
https://ibb.co/3MLrZJQ
really thanks for their goodness imunify didnt detect it
A WordPress moderator wrote it is a false positive.
https://wordpress.org/support/topic/wordpress-6-6/#post-17894454
Thanks for your information
i got it too it was false positive from CPGuard
Really good to hear that.