Ars Technica: Open source bug poses threat to sites running multiple CMSes. “Websites running the Drupal, Joomla, or Typo3 content-management systems are vulnerable to attacks that could possibly execute malicious code until administrators install just-released patches, developers and security researchers warned.”
ThreatPost: PHPMailer Bug Leaves Millions of Websites Open to Attack. “The vulnerability (CVE-2016-10033) is related to the way websites handle web-based email submission forms using the PHPMailer component. PHP is an (Hypertext Preprocessor) open-source scripting language embedded into website HTML. PHPMailer is a popular component used by an estimated 9 million sites for handing tasks such as email submission and registration forms. According to Golunski all version of PHPMailer released before version 5.2.18 are affected.”
Have a Joomla site? Please read this now: Critical vulnerabilities pose a serious threat to Joomla sites “…taken together, the vulnerabilities can be used to unlock any site running Joomla, anywhere on the internet, with little more than a polite request detailing what you’d like to be called and how much power you want. And there are a millions of vulnerable Joomla sites out there.”
There’s a serious security issue with Joomla. If you’re using it please patch. “The Joomla security team have just released a new version of Joomla to patch a critical remote command execution vulnerability that affects all versions from 1.5 to 3.4. This is a serious vulnerability that can be easily exploited and is already in the wild. If you are using Joomla, you have to update it right now.” Attackers do appear to be active.
Are you using Joomla? Better patch. “Millions of websites used in e-commerce and other sensitive industries are vulnerable to remote take-over hacks made possible by a critical vulnerability that has affected the Joomla content management system for almost two years. The SQL-injection vulnerability was patched by Joomla on Thursday with the release of version 3.4.5. The vulnerability, which allows attackers to execute malicious code on servers running Joomla, was first introduced in version 3.2 released in early November 2013. Joomla is used by an estimated 2.8 million websites.”
The ResearchBuzz Firehose is regular RB content presented as individual posts.
For digest-type posts a couple of times a day, please visit ResearchBuzz.
Want to know how to best use the Firehose for content discovery?
Check out this handy article.