Patch/Configuration Management

BleepingComputer reports that the White Phoenix ransomware decryption tool has been made available on the web by CyberArk to ease the recovery from attacks involving ransomware strains with intermittent encryption, such as ALPHV/BlackCat, BianLian, DarkBit, Agenda/Qilin, and Play, months after the decryptor was released as a Python project on GitHub.

CVE-2024-0402, CVSS score 9.9, may affect more than 4,800 unpatched GitLab servers.

Mandiant and CISA say security teams should prioritize the bugs as Ivanti released patches Jan. 31.

Fortra recommends security teams patch critical CVE immediately. Security pros say hackers with even moderate skills can exploit bug.

A critical zero-click account takeover exploit affects GitLab Community and Enterprise Editions.

Global attacks targeting Ivanti Connect Secure VPN appliances vulnerable to both CVE-2023-46805 and CVE-2024-21887, have been underway, with 492 of 26,000 internet-exposed devices being compromised with backdoors, reports Ars Technica. The U.S. accounted for the most number of impacted VPNs, with Germany, South Korea, China, and Japan having the next largest number of compromised devices, a report from Censys showed. Most of the infected VPNs were discovered to be hosted by Microsoft's customer cloud service. The findings also showed a credential theft backdoor among 412 hosts. "Additionally, we found 22 distinct 'variants' (or unique callback methods), which could indicate multiple attackers or a single attacker evolving their tactics," said researchers.

Apple released patches for a zero-day flaw that it said “may have been exploited” in iPhone and macOS systems.

Attacks exploiting a critical out-of-bounds write zero-day vulnerability in VMware Center Server, tracked as CVE-2023-34048, have been deployed by Chinese cyberespionage operation UNC3886 since 2021, two years before the flaw was identified and addressed, reports The Hacker News.