Drupal Updates, Zyxel Firewall Patches, Candiru’s DevilsTongue, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 22 July, 2022
Episode 271 - 22 July 2022
Drupal Updates- https://www.securityweek.com/code-execution-and-other-vulnerabilities-patched-drupal
Zyxel Firewall Patches -
https://portswigger.net/daily-swig/zyxel-firewall-vulnerabilities-left-business-networks-open-to-abuse
PayPal Double Spear Phishing -
https://www.infosecurity-magazine.com/news/paypal-used-send-malicious-double/
Okta Too Open- https://threatpost.com/risks-okta-sso/180249/
Candiru’s DevilsTongue -
https://www.bleepingcomputer.com/news/security/chrome-zero-day-used-to-infect-journalists-with-candiru-spyware/
Hi, I’m Paul Torgersen. It’s Friday July 22nd, 2022, and from Victoria one last time, this is a look at the information security news from overnight.
From SecurityWeek.com:
Drupal has released patches for four vulnerabilities. The most critical flaw affects Drupal 9.3 and 9.4. and it can lead to arbitrary PHP code execution on Apache web servers. The other three vulnerabilities also impact the Drupal core and can lead to cross-site scripting attacks, information disclosure, or access bypass. Get your patch on kids.
From PortSwigger.net:
Zyxel has released patches for several of its firewall products following the discovery of two security vulnerabilities that left business networks open to exploitation. One is an authenticated directory traversal vulnerability in the Common Gateway Interface, and the other is a local privilege escalation vulnerability that was identified in the command-line interface. You should update to the latest versions as soon as you can.
From Infosecurity-Magazine.com:
Threat actors are using PayPal to send out phishing invoices. PayPal domains are usually “allow-listed” by organizations’ email filters, so cyber-criminals are registering accounts and composing malicious invoices on the platform. Many are spoofing Norton products, but substituting their own information for payments. They even have someone answering the included Customer Service number to continue the charade to extract dollars from their victims.
From ThreatPost.com:
Four newly discovered attack paths in the products for IAM vendor Okta could lead to PII exposure, account takeover, or even organizational data destruction. Note that the researchers call these “attack paths” and not vulnerabilities. Okta says this is a non issue and all you need to do is tweak up your security profile a little, which is beyond what they offer as their default settings. You can see the details in the article.
And last, from BleepingComputer.com:
The Israeli spyware vendor Candiru was found using a Google Chrome zero day to spy on journalists and other high-interest individuals in the Middle East with their 'DevilsTongue' spyware. Threat researchers from Avast, who discovered the vulnerability and reported it to Google, revealed that they unearthed the flaw after investigating spyware attacks on their clients. The vuln was patched on July 4. Details and a link to the research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next next time, be safe out there.