Category: Cybersecurity News (Page 1 of 7)

Malware

Drupal Releases PSA About Critical Vulnerability

In March, Drupal released version 8.5.1 addressing several critical security vulnerabilities. At that time, there was no evidence of the vulnerability being exploited to attack Drupal sites However, on April 12, 2018, a security research firm released a detailed analysis of the vulnerability and steps to exploit it.  In the days since this release, multiple exploits of the Drupalgeddon2 vulnerability have been reported.

Read More

importance of mobile security

Decoding Security 117: Security on the Go

Continuing to deal with the fallout from the Cambridge Analytica data scandal, last week, Facebook founder and CEO Mark Zuckerberg, testified before U.S. Congress admitting he never audited Cambridge Analytica to ensure the Facebook user data collected had been deleted. Also in the news this week, Panera Bread experienced a data breach that exposed millions of customers’ personal data for as long as eight months. Despite being warned by multiple security researchers, Panera did not disclose or address the leak until last week.

Read More

Malware

WordPress Security and Maintenance Update 4.9.5 Released

Last week, WordPress released version 4.9.5 — a security and maintenance release. This release addressed three major security vulnerabilities and 25 other bugs. These vulnerabilities are considered low severity, and are part of an overall mission at WordPress to further enhance the security of the core application.

Read More

Malware

Drupal Releases Highly Critical Security Update

On March 28, 2018 Drupal released a highly critical security update affecting Drupal sites using version 7.x and 8.x. This security update addresses a critical vulnerability impacting approximately 1 million websites that could allow attackers to exploit multiple access points and take control of Drupal sites. In order to address the issue, Drupal has released two new versions and is recommending that all Drupal sites be updated as soon as possible.

Read More

Decoding Security 115: Getting the Right Web Security

The Equifax breach dominated headlines in September 2017, and is once again making news. Last week former Equifax CIO, Jun Ying, was found guilty of selling all of his company stock, knowing it would soon be worthless, before the 2017 security breach was made public. In other cybersecurity news, your Decoding Security hosts also discuss the recently disclosed RyzenFall vulnerability, which could allow cybercriminals to copy data from secure areas of millions of computers.

Read More

Malware

Joomla! Releases Security Update in Version 3.8.6

On March 13, 2018, Joomla! released a security update in version 3.8.6. This update addresses a SQLi vulnerability found in the User Notes component.  The notes section allowed for malicious code to be passed to the database. The update released by Joomla! limits input into the notes field to plain text and disallowing code.  It is highly recommended that Joomla! users update their applications as soon as possible to address this vulnerability and avoid possible compromises. Thanks to its included continuous scanning, SiteLock Infinity users will have their applications patched quickly and automatically.

In addition to the SQLi vulnerability fix, version 3.8.6 included 60 other bug fixes and feature updates including:

  • Session management improvements
  • Hide configuration and system information from non-super users
  • Delete existing passwords when user passwords are changed
  • PHP 7.2 compatibility fixes

In order to take advantage of bug fixes and improved features, users must complete the full version upgrade even if they have patching services.

If you’re interested in automated patching services for your Joomla! site, contact us today and ask about SiteLock Infinity. We are available 24/7 at 855.378.6200.

SiteLock Threat Intercept

Threat Intercept: Fake IonCube Malware Found in the Wild

THREAT SUMMARY

 

Medium Threat
Learn More   

Category:PHP Eval Request

First Identifiable Data: 02/01/2018

CVD ID: N/A

Trend Name: Value

Vector: Multiple

The threat rating was determined using the following metrics:

Complexity:

Brief explanation Lorem ipsum dolor sit amet.

Confidentiality Impact:

Brief explanation

Integrity Impact:

Brief explanation


While reviewing an infected site, the SiteLock Research team found a number of suspiciously named, obfuscated files that appear almost identical to legitimate ionCube-encoded files. We determined the suspicious ionCube files were malicious, and found that hundreds of sites and thousands of files were affected. We will discuss the defining features of the malware, its purpose, and discuss mitigation for infected sites.

Read More

Malware

Drupal Releases Critical Security Updates

Last week Drupal released version 8.4.5, which addressed several critical security vulnerabilities.  The Drupal development team is urging all Drupal sites to upgrade immediately to avoid possible exploitation of these vulnerabilities in the core application.

Read More

Web Application Security

Alert: Joomla! 3.8.4 Released Today With Important Security Updates

The Joomla! team has been hard at work today releasing version 3.8.4, which contains multiple security updates and bug fixes. Specifically, four major security vulnerabilities were found in Joomla! core files. These vulnerabilities impact all Joomla!  versions from 1.5 to 3.7. Three of the four vulnerabilities identified were cross site scripting (XSS) vulnerabilities found in modules and components within the core application. These vulnerabilities could potentially allow attackers to inject malicious code into otherwise legitimate website files. The fourth vulnerability, a  SQL injection (SQLi) vulnerability, was identified in the post-install message and could have allowed attackers to inject malicious code into the Joomla! MySQL database.  

Read More

sitelock podcast

Decoding Security 109: New Year’s Resolutions

If your New Year’s resolution is to protect yourself from cyberattacks, you’re in luck! This week on Decoding Security, security analysts Jessica Ortega and Ramuel Gall share their predictions for the top cybercrime trends in 2018. Our hosts also identify ways you can arm yourself against these ever-evolving threats. We don’t want to give away their predictions, but we’ll give you a hint: if your holiday gifts included a digital assistant like Amazon Alexa or Google Home, be sure to tune in!

We’ll also catch you up on the latest cybersecurity news, including the 25 Worst Passwords of 2017 and a leaky server that exposed 300,000 email addresses and login credentials from Ancestry.com.

Happy New Year from SiteLock and Decoding Security! Our New Year’s resolution is to continue to bring you a fun and informative podcast, so make sure you keep up by subscribing on YouTube,  iTunes, or Google Play!

Page 1 of 7

Powered by WordPress & Theme by Anders Norén