Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.
Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released. They said around 1345 GMT on Wednesday that a new version fixing the vulnerabilities was live.
But with reports that hackers were exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.
Read more…
Source: CNBC News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware
June 28, 2022
Trend Micro Research recently analyzed several cases of a Log4Shell vulnerability being exploited in certain versions of the software VMware Horizon. After investigating the chain of events, they found that many of these attacks resulted in data being exfiltrated from the infected systems. However, the researchers also found that some of the victims were infected ...
- 2022 CWE Top 25 Most Dangerous Software Weaknesses
June 28, 2022
The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, has released the 2022 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses list. The list uses data from the National Vulnerability Database to compile the most frequent and critical errors that can lead to serious vulnerabilities in software. An ...
- CISA Adds Eight Known Exploited Vulnerabilities to Catalog
June 27, 2022
CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the “Date ...
- CISA: Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
June 23, 2022
The Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard Cyber Command (CGCYBER) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat (APT) actors, have continued to exploit CVE-2021-44228 (Log4Shell) in VMware Horizon® and Unified Access Gateway (UAG) servers to obtain initial ...
- CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report
June 22, 2022
CISA is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography or broken authentication schemes, insecure firmware updates and remote code execution via native functionality. CISA has released six corresponding ...
- Critical PHP flaw exposes QNAP NAS devices to RCE attacks
June 22, 2022
QNAP has warned customers today that most of its Network Attached Storage (NAS) devices are vulnerable to attacks that would exploit a three-year-old critical PHP vulnerability allowing remote code execution. “A vulnerability has been reported to affect PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11. If exploited, the vulnerability allows attackers to ...