Latest / Daily DefSec Brief / PHP2Shell hits Palo Alto firewalls, Cisco ASA VPN zero-day | Cyber Security News Oct 29
Transcript
- Jerry: Certificates now expire about twice as often as they did a year ago. Plenty of IT leaders say they're ready for it. This is the daily DefSec brief for Thursday, October twenty-ninth, twenty twenty six. If you do only one thing today, type firewall management interfaces off the internet. One, an update on PHP to show the PHP flaws we covered last week. Attackers are now using them against firewalls. The flaws can let an attacker run code on a server through PHP. Palo Alto says his own firewall management pages are being hit when they're exposed to the internet. CISA also lists a Linux kernel flaw that attackers chain with them to get root. Researchers at Dream found one crew that searched about 19,000 firewall management pages online. It picked 240 of them as targets. That crew went on to Active Directory. Dream didn't name the firewall vendor, take the PanOS management interface off the internet, and apply the hotfix. two. Attackers are crashing Cisco ASA and FTD firewalls through the SSL VPN login page before anyone signs in. It works when secondary authentication is set up on a tunnel group. Each crash drops everyone's remote access. It's the second exploited crash bug in this VPN since August. The fix came out yesterday. Patch your ASA and FTD VPN firewall Attackers are already trying a new Oracle eBusiness suite flaw against decoy servers. Anyone who can reach the server over the web can use it to run code. Oracle fixed it in last week's quarterly update. Apply Oracle's October patch to e-business suite. That's where the finance data sits. 4. Talos says attackers planted an implant on Cisco SD-WAN controllers. It copies the keys that protect the network's traffic. Attackers got in through an authentication bypass that Cisco fixed in February. On a controller that was already compromised, a patch leaves an implant in place. Any keys it already sent out, stay with the attackers. Hunt your SD WAN controllers with the indicators talos published. Five, CESA says attackers are exploiting a VMware ESX flaw that lets an admin do certain things without leaving a log entry. It only helps someone who already has the admin on your hypervisors. That makes a clean ESX log weak evidence. VMware fixed it in July. Apply those ESX updates. Six, no attacks yet, but Watch Guard fixed seven critical flaws in its Firebox firewalls. In the SIP proxy fire cluster and the access portal, three of them can be reached over the network before login. Update Watch Guard Fireware. Seven No attacks yet, but Mozilla's latest Firefox release fixes more than 160 security flaws. Mozilla rates most of them high. Push the Firefox update. Eight. Microsoft is retiring the SMS and voice codes Entra ID sends it sign-in starting February first. Users will get a prompt they can't skip to set up a pass key if SMS or voice is all they have. Move your entree users off SMS and voice codes before then, and be sure to understand that this is a very common trick that attackers use to lure people into disclosing their credentials. Nine, no attacks yet, but WordPress fixed a flaw in its own update process. By requesting the right page in the seconds an update takes, anyone can run the installer against their own database. That ends with their code running on your web server. PatchDack calls it impractical to exploit. Update WordPress core anyway. ten. Ultralytics has seven flaws with no patch and no attacks reported yet. it's the Python library a lot of teams use to run yellow vision models. Attackers can run code on a machine by getting someone to open a malicious model or dataset file with it. ZDI's timeline shows no reply from the maintainers. Load ultra lentics files only from sources you control. 11. Sectigo asked 500 IT leaders about certificate renewals. Forty percent said they're very prepared for monthly renewals because their automation is already in place. 4% automate more than 9 in 10 of their renewals. 61% had a certificate outage or incident in the past year. The maximum certificate lifetime drops to 100 days next March. Automate your TLS certificate renewals before then. Confidence, it turns out, renews itself automatically. Once more, get firewall management interfaces off the internet. Thanks for watching. Sources are in the show notes. subscribe, and share the show with a friend who'd use it. I'm Jerry Bell and I'll be back again tomorrow.