Patch/Configuration Management

Gain insights into the CISA KEV straight from one of the folks at CISA, Tod Beardsley. Learn how KEV was created, where the data comes from, and how you should use it in your environment. This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Resource: https://cisa.gov/kev

While the DDoS attack was the initial trigger, Microsoft said it was “amplified” by an internal misconfiguration.

Such advice from CISA follows several reports noting that between 13,000 and 42,000 ServiceNow systems may be compromised through the flaws, most of which were noted by Resecurity to be in the U.S., the UK, India, and the European Union.

Microsoft researchers said attackers sought to gain full administrative privileges on ESXi servers via Active Directory.

All Telerik Report Server instances before version 10.1.24.709 are affected by the bug, which could be leveraged to facilitate remote code execution, according to Progress Software.

Threat actors exploiting the flaw, tracked as CVE-2023-45249, could facilitate remote code execution without any authentication or user interaction in Acronis Cyber Protect instances.

Researchers say that a years-old security leak is putting a number of production model PCs at risk of persistent remote takeover.