(For a video version of the opening comments below, click this link)
Hello all,
I was expecting a quieter week, but I was surprised by how many serious vulnerabilities were revealed, and about the drama surrounding MITRE and their CVE contract, spawning at least two new numbering authority prospects in response. I sincerely hope that these players will cooperate, otherwise a trifurcation of this important service will do more harm than good.
Headline NEWS:
- Apache Roller an open-source, Java-based blogging server software, has a hole large enough to be seen from almost-space by Katy Perry, scoring a perfect ten on CVSS. The fix is to update to the latest version.
- Apple plugged a couple of zero-day vulnerabilities that the iFruit company reported were being exploited against targeted individuals. CISA has ordered all Federal agencies must update by May 8, 2025. Check your system for updates to keep the fruit flies away.
- ASUS has released updates for some routers to plug an authentication bypass defect when using their AiCloud. This is as bad as it gets because it needs no authentication to exploit. If your device has an update, do so ASAP. If yours is EOL, turn off the AiCloud feature.
- Atlassian released “seven updates that address four high-severity flaws impacting third-party dependencies in Bamboo, Confluence, and Jira, including some that were publicly disclosed nearly six years ago.” If you use a self-hosted version of this, it would be wise to update quickly.
- MITRE (Massachusetts Institute of Technology Research Establishment) had funding renewed by CISA at the 11th hour for another 11 months so that it can continue to provide both the Common Vulnerabilities and Exposures Program, and Common Weakness Enumeration program. During the course of the drama and outcry over the potential shutdown of this valuable worldwide resource, several other independent bodies announced that they too will begin performing CVE and CWE enumeration and enrichment. Let’s hope they cooperate and don’t compete.
- Cisco Webex has a defect that enables someone to “execute arbitrary code remotely by convincing a user to click on a crafted meeting invite link and download arbitrary files”. In other words, a bad guy can send a meeting link and compromise your system. Update to the latest version to plug this hole.
- Google Chrome and Mozilla Firefox released new versions to patch severe vulnerabilities this past week. Naturally, browsers based on Chromium and the Gecko engines will be following suit shortly. Make sure you check your browser for updates, or at the least close and reopen it, which should trigger an update cycle on most.
- Erlang/Open Telecom Platform (OTP) has a critical defect in SSH, with a perfect CVSS of 10.0 that requires patching. Unfortunately for most of us, this needs to be patched by our hardware or software vendors. If you do not have a patch available, take mitigating action such as disabling SSH, or at the least limit access to only specific IP addresses via firewall and port rules – which is best practice anyway.
- Widespread Microsoft Entra Account Lockouts were apparently errantly triggered by a new Microsoft Enterprise App that was installed on Friday. Yes, on a holiday weekend! Before Redmond realized their blunder, thousands of accounts worldwide had been flagged as at “High Risk” and locked. It could be an interesting Monday for lots of IT folk.
In Ransomware, Malware, and Vulnerabilities News:
- Data Poisoning is something that I’ve mostly associated with vengeful or disgruntled employees. But a recent article posits, what if ransomware actors do this? There have been recent news reports of attacks on water pumping stations that had levels of chemicals altered, which would have been lethal if not caught. A restaurant employee maliciously added a warning about peanuts on menu items. What if that had been the other way around? Now imagine an evil ransomware dirtbag infiltrating a hospital and altering patient records, removing allergy lists, changing medications, or how about accessing financial records and altering numbers, finding research files and making changes. How long would it take to find that needle in a haystack? Could you do it before someone died, or a company couldn’t meet payroll or pay suppliers? Sadly, these scenarios are highly possible and easy to perform. And I don’t think we’re ready for them.
In Other News Events of Note and Interest:
- Microsoft Patch Tuesday brought a bunch of needed fixes, but it also brought a goodly amount of chaos as well. Windows 2025 servers encountered a problem with firewall profiles, Outlook Classic has random CPU spikes, random Blue Screens Of Death popping up on Windows 11 systems, Windows Hello logins not working and more. Even with these highly annoying defects, it is still in your best interest to apply the patches, if your system can handle them. Active exploitation against the patched defects is already underway. The disease is still worse than the cure, but not by much it seems.
Musings:
My wife enjoys feeding the critters in our backyard. She has a birdfeeder that brings her hours of entertainment, watching the wide variety of feathered friends that enjoy the free feast. The squirrels didn’t take long to notice the buffet and the fuzzy-tailed threat actor rats tried to get in on the action. Thankfully, after a bit of research, I found that a squirrel baffle on the feeder pole will keep them from being able to climb up. So now they forage underneath it for gleanings dropped by my wife’s prized plumed avians. But I must stay vigilant as trees and other plants grow up near the feeder and if not pruned provide the unwanted intruders with a springboard to bypass my defenses. In the same way, we need to ensure that we’re pruning our digital worlds. We tend to accumulate technology, and keep it around forever without retiring it, and sometimes entirely forgetting it. Don’t leave springboards around for unwanted fuzzy-tailed rats. Prune that old tech.
Keep the shields up!
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence
- CISA Issues Alert on Actively Exploited Apple 0-Day Vulnerabilities
- ASUS warns of critical auth bypass flaw in routers using AiCloud
- Vulnerabilities Patched in Atlassian, Cisco Products
- CISA extends MITRE-backed CVE contract hours before its lapse
- Cisco Webex bug lets hackers gain code execution via meeting links
- Chrome 135, Firefox 137 Updates Patch Severe Vulnerabilities
- Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution
- Entra User at High Risk – leaked credentials
- Widespread Microsoft Entra lockouts tied to new security feature rollout
Ransomware, Malware, and Vulnerabilities News
- FBI most wanted cyber criminals
- Bill extends cyber threat info-sharing between public, private sector
- US Senators Push for Stronger Cybercrime and Computer Fraud Legislation
- Report Calls for Creation of National Information Clearinghouse for Cybercrime Data – Urges FBI to Adopt New System for Categorizing Cybercrimes
- FBI issues warning — hackers are using fake PDF converters to spread malware and steal your passwords
- Creator of $132 Million Global Phishing Service Jailed for Eight Years
- CISA warns of potential data breaches caused by legacy Oracle Cloud leak
- CISA tags SonicWall VPN flaw as actively exploited in attacks
- CVE Foundation Launched to Ensure the Long-term Vulnerability Tracking
- Threat Actors Manipulate Search Results to Direct Users to Malicious Websites
- Apple says zero-day bugs exploited against ‘specific targeted individuals’ using iOS
- FortiGate 0-Day Exploit Allegedly Up for Sale on Dark Web
- Over 16,000 Fortinet devices compromised with symlink backdoor
- Calix Pre-Auth RCE on TCP port 6998 Allow Arbitrary Code Execution as Root User
- Attackers exploit zero-day flaw in Gladinet CentreStack file-sharing platform
- Hackers Actively Exploiting Critical Exchange & SharePoint Server Vulnerabilities
- Big Banks Alarmed After Their Regulator Gets Hacked
- Majority of Browser Extensions Can Access Sensitive Enterprise Data, New Report Finds
- Cybersecurity firm buying hacker forum accounts to spy on cybercriminals
- TraderTraitor: The Kings of the Crypto Heist
- Cracked cybercrime forum reemerges
- Minister Lucy Powell’s X account hacked to promote crypto scam
- Deepfake-Enabled Fraud Has Already Caused $200 Million in Losses in 2025
- AI Hallucinations Create a New Software Supply Chain Threat
- The quiet data breach hiding in AI workflows
- Google used AI to suspend over 39M ad accounts suspected of fraud
- AWS keys leaking, hackers abuse native-encryption
- Critical PHP’s extract() Function Vulnerability Allows Arbitrary Code Execution
- Experts Uncover New XorDDoS Controller, Infrastructure as Malware Expands to Docker, Linux, IoT
- Microsoft 365 Will Turn Off ActiveX, Because Hackers Keep Using It
- Hackers Leveraging Teams Messages to Execute Malware on Windows Systems
- Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler
- Windows 11 Escalation Vulnerability Let Attackers Gain Admin Access Within 300 Milliseconds
- Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool
- Immutable backup storage is the best protection against ransomware, but many businesses don’t have it
- Notorious internet messageboard 4chan has been hacked, posts claim
- Notorious image board 4chan hacked and internal data leaked
- Hertz says customers’ personal data and driver’s licenses stolen in data breach
- 6 Million People Impacted by Data Breach at Laboratory Services Cooperative
- Landmark Admin data breach impact now reaches 1.6 million people
- Food retail giant behind several major US supermarket brands confirms data stolen in major ransomware breach
- Govtech giant Conduent confirms client data stolen in January cyberattack
- CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
- Threat Actors Launch Active Attacks on Semiconductor Firms Using Zero-Day Exploits
- DPRK IT Workers in Open Source and Freelance Platforms
- China escalates cyber fight with U.S., names alleged NSA hackers
- China pursuing 3 alleged US operatives over cyberattacks during Asian Games
- Chinese espionage group leans on open-source tools to mask intrusions
- China admitted its role in Volt Typhoon cyberattacks on U.S. infrastructure
- Chinese Hackers Exploit Ivanti VPN Vulnerabilities to Infiltrate Organizations
- Chinese APT Mustang Panda Debuts 4 New Attack Tools
- Midnight Blizzard deploys new GrapeLoader malware in embassy phishing
- State-Sponsored Hackers Weaponize ClickFix Tactic in Targeted Malware Campaigns
- TROX Stealer: A deep dive into a new Malware as a Service (MaaS) attack campaign
- AI Presentation Tool Leveraged in Phishing Attacks
- ResolverRAT Campaign Targets Healthcare, Pharma via Phishing and DLL Side-Loading
- Guess what happens when ransomware fiends find ‘insurance’ ‘policy’ in your files
- DaVita Says Ransomware Attack Affecting Some Operations
- Ahold Delhaize confirms data theft after INC ransomware claims attack
- Mayor of Fall River confirms school system was hit with a ransomware attack
- Oregon DEQ rebuilds servers, employee computers after cyberattack
- City of Blaine, MN investigates network security incident
- Black Basta: The Fallen Ransomware Gang That Lives On
- Interlock ransomware gang pushes fake IT tools in ClickFix attacks
- Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector
- Ransomware Hackers Target Active Directory Domain Controllers
- Only Half of Ransomware Victims Recover Data After Paying, Finds CyberEdge Group’s 2025 Cyberthreat Defense Report
- Rewterz Releases Annual Threat Intelligence Report 2024 Highlighting Key Cybersecurity Trends and Threat Actor Activity
- Data Poisoning: The Next Evolution of Ransomware That No One is Ready For
Other News Events of Note and Interest
- Cool Tool: Chipolo’s colorful new trackers now work with Apple’s and Google’s networks
- Cool Tool: AI-boosted cameras help blind people to navigate
- Daddy of a mistake by GoDaddy took Zoom offline for about 90 minutes
- Unpowered SSD endurance investigation finds severe data loss and performance issues
- Quantum Computing Group Offers 1 BTC to Whoever Breaks Bitcoin’s Cryptographic Key
- Bots now account for over half of all internet traffic
- NIST Offers ‘Significant’ Update to 2020 Privacy Framework
- TP-Link becomes a CVE Numbering Authority to improve cybersecurity
- Unitree’s G1 Humanoid Robot Prepares for Iron Fist Awakening Boxing Match by Sparring with a Human
- Windows 11 24H2 is now more stable with Nvidia driver 576.02
- SSL/TLS certificate lifespans reduced to 47 days by 2029
- Why shorter SSL/TLS certificate lifespans matter
- The future of authentication: Why passwordless is the way forward
- In first, Japan issues cease-and-desist order against Google
- Notion Mail adds some AI organization to Gmail email inboxes
- Judge Rules Google Operates Illegal Ad Monopoly
- Google 2024 Ad Safety Report
- Google Search switching to google.com around the world
- Google adds Android auto-reboot to block forensic data extractions
- Google Cloud’s so-called uninterruptible power supplies caused a six-hour interruption
- A Realistic AI Timeline
- AI has grown beyond human knowledge, says Google’s DeepMind unit
- NVIDIA to Manufacture American-Made AI Supercomputers in US for First Time
- Everything Wrong with MCP
- How To Build An Agent
- “Weakening encryption would make European security worse” – the VPN industry reacts to the EU’s plan for end-to-end encryption backdoors
- Synology confirms that higher-end NAS products will require its branded drives
- Meta Fights to Keep Instagram and WhatsApp, as Antitrust Trial Begins
- Meta CEO Zuckerberg considered spinning off Instagram 2018: FTC trial
- What does Microsoft’s new ReFS file system mean for Windows?
- Microsoft confirms plan to kill its legacy PDF reader in Edge soon
- No wonder why people hate OneDrive — Microsoft has left the file sync app broken for nearly a year
- Microsoft Copilot Vision, an AI feature that can “see” your screen, is now available for free in the Edge browser
- What Is Copilot? Everything You Need to Know About Microsoft’s AI Tools
- Microsoft: Windows Server 2025 restarts break connectivity on some DCs
- Microsoft: New Windows updates fix Active Directory policy issues
- New Windows Server emergency updates fix container launch issue
- Microsoft warns of CPU spikes when typing in classic Outlook
- Microsoft warns of blue screen crashes caused by April updates
- Windows 11’s April update is triggering BSODs for no reason, and the only fix is to wait
- Windows 11 24H2 Update Bug Triggers BSOD Error – Emergency Fix
- The Windows 11 April update is wreaking havoc with Windows Hello login processes
- VMware 72 core licensing reversal
- VMware revives its free ESXi hypervisor in an utterly obscure way