Palo Alto updates patching guidance for command injection vulnerability

https://security.paloaltonetworks.com/CVE-2024-3400

This is a command injection vulnerability that enabled an unauthenticated attacker to execute code with root privileges. POC has been released publicly.

Device telemetry does not need to be enabled for PAN-OS firewalls to be exposed to attacks related to this vulnerability.

You can verify whether you have a GlobalProtect gateway or GlobalProtect portal configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals).

https://unit42.paloaltonetworks.com/cve-2024-3400

Hackers are targeting public internet facing Veeam backup servers

https://www.bleepingcomputer.com/news/security/hackers-target-vulnerable-veeam-backup-servers-exposed-online/

Twitter bug (now fixed) allowed “legacy” Blue Checkmark users to get them back for free.

https://www.bleepingcomputer.com/news/technology/twitter-bug-lets-legacy-verified-accounts-get-the-blue-check-back/

Proof of Concept (POC) exploit published for vulnerability in Microsoft Word with Preview Pane execution

https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/

Bug from Kia and Hyundai TikTok car theft challenge fixed

https://www.govinfosecurity.com/kia-hyundai-fix-tiktok-security-challenge-a-21226

Vulnerability disclosed in Cisco IP 7800 and 8800 series (except 8821) phones that allows RCE and DoS. Workaround available but no patch

https://www.bleepingcomputer.com/news/security/cisco-discloses-high-severity-ip-phone-bug-with-exploit-code/

CISA: Windows and UnRAR vulnerabilities actively being exploited

https://www.bleepingcomputer.com/news/security/cisa-warns-of-windows-and-unrar-flaws-exploited-in-the-wild/

FEMA: Vulnerabilities in Emergency Alert System (EAS) can allow bad actors to issue “alerts” over TV, radio and cable networks

https://therecord.media/fema-issues-warning-to-emergency-alert-system-managers-that-devices-could-be-hacked/

Exploitations of MSDT Zero-Day (“Follina”) spotted in Australia

Outbreak of Follina in Australia

Atlassian discloses critical zero-day RCE vulnerability in Confluence (CVE-2022-26134) that is actively being exploited and fixes next day. Patch now!

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

https://www.bleepingcomputer.com/news/security/atlassian-fixes-confluence-zero-day-widely-exploited-in-attacks/