Subscribe
Share
Share
Embed
Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
[0:00] Today on Wordfence Security News, two critical vulnerabilities in The Events Calendar were under attack hours after disclosure.
[0:07] N-able's maximum severity flaw now outlives its federal patching deadline.
[0:11] StyleSmuggler exploited Adobe Commerce and Magento before a patch existed.
[0:16] A critical GitLab vulnerability drew probing within a day of disclosure.
[0:21] And a medium-rated Chrome vulnerability was under attack before Google's fix.
[0:30] This is Wordfence Security News, I'm Alex Thomas.
[0:35] A widely used WordPress Events plugin
[0:38] patched two critical vulnerability chains,
[0:40] Wordfence's own firewall logged exploit attempts
[0:43] within hours of disclosure.
[0:44] On September 10th, the team behind The Events Calendar,
[0:47] a widely used WordPress scheduling plugin,
[0:51] completed fixes for two critical vulnerability chains.
[0:54] Both can ultimately let an unauthenticated attacker
[0:57] execute code on a targeted server.
[0:59] In our own firewall data at Wordfence, the first logged exploit request was seen about 22.6 hours after the patch and about 2.2 hours after public disclosure.
[1:10] Both attacks start with a malicious comment on a public event.
[1:14] When the plugin displays that comment, the hidden payload can either run code directly or take over an administrator account.
[1:22] The built-in WordPress comment moderation requirement doesn't prevent exploitation.
[1:26] WordPress hands the commenter, in this case the attacker, a link to view their own pending comment,
[1:33] and loading that link renders it through the vulnerable path before a moderator sees it.
[1:38] Over roughly four and a half days, Wordfence's firewall matched 3,285 requests across 619 websites.
[1:46] About two-thirds of them, or 2,103, contained payloads consistent with exploitation.
[1:53] Wordfence Premium, Care, and Response customers have had a firewall rule blocking both chains since August 22nd, more than two weeks before the final patch version was released.
[2:04] Free users are scheduled to receive the same rule on September 21st after the standard 30-day delay.
[2:10] If you run The Events Calendar, we suggest updating to version 6.17.4.1 or later.
[2:17] If you can't patch immediately, confirm your Wordfence firewall is active and protecting.
[2:21] As always, a firewall rule mitigates risk, but is not a replacement for patching.
[2:26] We also suggest looking for unfamiliar PHP files, unexpected administrator accounts,
[2:31] or unexplained administrator password changes after September 10th.
[2:36] Any of those existing should trigger a full compromise investigation.
[2:42] N-able has fixed a maximum severity vulnerability in N-central that lets attackers run code before login.
[2:49] The federal deadline CISA set for fixing it already passed, leaving unpatched servers overdue and exposed.
[2:55] N-able has shipped a fix for a maximum severity vulnerability in its N-central remote monitoring platform.
[3:02] Arctic Wolf Labs says the bug lets an unauthenticated attacker run code on the server before logging in,
[3:09] allowing them to take over the platform.
[3:12] N-central is the software many managed service providers use to control client computers remotely.
[3:17] CISA added the flaw to its Known Exploited Vulnerabilities Catalog on September 8th.
[3:22] Its remediation deadline for federal civilian agencies was September 11th,
[3:27] so affected federal systems are overdue, and any unpatched internet-facing N-central server remains exposed.
[3:35] If you run N-central on-premises, we suggest applying the vendor's fix now
[3:39] and treating any unpatched instance as potentially compromised
[3:43] while you investigate N-able's published indicators and review accounts and logs.
[3:49] A zero-day in Adobe Commerce and Magento, nicknamed StyleSmuggler,
[3:54] was being exploited three days before Adobe released a fix,
[3:57] and the federal deadline to patch it has already passed.
[4:01] SanSec says it found attackers exploiting a code execution flaw in Adobe Commerce
[4:06] and Magento Open Source starting September 4th, three days before Adobe had a fix,
[4:11] and Aikido Security says StyleSmuggler is an unauthenticated attack.
[4:17] Tenable Research says multiple victim stores were confirmed as compromised across separate campaigns.
[4:23] Adobe released a hotfix on September 7th, three days after exploitation began.
[4:28] Adobe rates it critical with a CVSS score of 10.0.
[4:31] CISA added it to its Known Exploited Vulnerabilities Catalog on September 8th.
[4:35] CISA's remediation deadline for federal civilian agencies was September 11th.
[4:40] If you run Adobe Commerce or Magento Open Source, we suggest applying Adobe's hotfix now,
[4:45] because exploitation preceded the patch, also scan for compromise,
[4:50] and rotate exposed credentials using Adobe and SanSec guidance.
[4:57] GitLab patched a critical unauthenticated path traversal flaw on September 10th,
[5:02] and CISA added it to the Known Exploited Vulnerabilities Catalog the next day.
[5:07] Security Affairs says attackers were probing it within 24 hours of disclosure.
[5:12] CISA's remediation deadline for federal civilian agencies is September 14th.
[5:16] If you run a self-managed GitLab community or enterprise edition instance,
[5:22] update to version 19.3.2, 19.2.6, or 19.1.8,
[5:29] and review API logs for suspicious post requests to repository commit endpoints
[5:35] containing file.path parameters.
[5:38] Google published a Chrome update on Tuesday, September 8th,
[5:41] with 230 security fixes.
[5:44] One of them was already being used in active attacks.
[5:46] The vulnerability is an out-of-bounds write in the V8 JavaScript engine.
[5:50] An attacker can exploit this vulnerability using a crafted webpage
[5:53] to run code inside Chrome's sandbox.
[5:56] Google says an exploit for it exists in the wild,
[5:59] and CISA added it to its Known Exploited Vulnerabilities list the next day.
[6:03] But Google rated it medium, not critical or high, and this one was given a $2,500 bounty found by a research intern at Seoul National University.
[6:14] This is a good reminder that a severity rating describes technical impact and exploitability characteristics.
[6:20] It doesn't tell you whether attackers are using the flaw right now.
[6:24] We suggest immediately updating your browser and restarting it.
[6:27] The flaw can affect multiple Chromium-based browsers, but fixed versions and release timing differ by vendor, so check your browser's vendor update guidance.
[6:37] Links to all the stories we covered today are in the description.
[6:40] Thanks for watching (or listening) and we'll see you next time on Wordfence Security News.