Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

Self-managed GitLab servers need yesterday’s critical patch. Upgrade before someone runs code on yours

Self-managed GitLab servers need yesterday’s critical patch. Upgrade before someone runs code on yours

A bug rated 10 out of 10 lets someone with no account run code on the server through a crafted…
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler

Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler

Four remote-access and backup fixes that piled up over the weekend, in the order we would do them....
Patched NetScaler last week? Check again, because Citrix has a new SAML fix

Patched NetScaler last week? Check again, because Citrix has a new SAML fix

Some September builds are still affected when NetScaler does SAML sign-in. The new floor is 14.1-73.46 or 13.1-64.29....

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

AhsayCBS backup servers need a second patch after the first one fell short

AhsayCBS backup servers need a second patch after the first one fell short

Attackers have been planting web shells on AhsayCBS since October 7. Hotfix 10.3.4.45 is the one that counts....
SonicWall SMA1000 remote access boxes are being probed three days after the fix. Install the October hotfix

SonicWall SMA1000 remote access boxes are being probed three days after the fix. Install the October hotfix

A no-login bug rated 10.0 started drawing attack traffic on October 9. The fix needs a reboot....
Ransomware crews are logging in through GlobalProtect VPNs without passwords. Upgrade and reset sessions today

Ransomware crews are logging in through GlobalProtect VPNs without passwords. Upgrade and reset sessions today

Qilin and Settra are using a Palo Alto bug fixed in May, and their sessions look like your remote staff....
Friday’s brief: forgotten servers on a seven-country advisory, then Splunk, Bricksforge and exposed dashboards

Friday’s brief: forgotten servers on a seven-country advisory, then Splunk, Bricksforge and exposed dashboards

One seven-country advisory about the servers you forgot, plus three fixes to finish before the weekend....
Your internal dashboards were never meant to be public — JPCERT says attackers are finding them anyway

Your internal dashboards were never meant to be public — JPCERT says attackers are finding them anyway

BI tools and employee-only admin systems are behind a wave of data leaks. The fix starts with a list of…
Attackers are planting web shells through Bricksforge forms — update WordPress sites built on Bricks today

Attackers are planting web shells through Bricksforge forms — update WordPress sites built on Bricks today

Exploited since Wednesday evening, no login needed. Version 3.1.8.10 closes it....
Splunk search head clusters can be taken over without a login — upgrade to this week’s release or switch off the sidecar

Splunk search head clusters can be taken over without a login — upgrade to this week’s release or switch off the sidecar

A 9.8 bug lets anyone who can reach a 10.2 or 10.4 search head cluster member run commands. Not exploited…
Seven countries just warned that attackers are still hunting forgotten FTP, DNS and Struts servers — find yours this weekend

Seven countries just warned that attackers are still hunting forgotten FTP, DNS and Struts servers — find yours this weekend

Old FTP, DNS and Struts boxes nobody watches are how one China-linked group gets in. Then it reads your email....
Thursday’s brief: FortiGate lockouts, then Nexus switches, hijacked AI servers, Atlassian exploits

Thursday’s brief: FortiGate lockouts, then Nexus switches, hijacked AI servers, Atlassian exploits

Stolen FortiGate logins are turning into lockouts and ransomware. The Atlassian bug from yesterday’s brief now has attackers....
Patch Jira and Confluence today: attackers are now testing the Atlassian bug we flagged yesterday

Patch Jira and Confluence today: attackers are now testing the Atlassian bug we flagged yesterday

A public exploit dropped Tuesday and honeypots lit up two hours later. If Jira talks to Crowd, the endgame is…