A new report says attackers are exploiting flaws in firewalls and VPNs, and two PHP flaws could expose the web pages used to manage those devices.
Attackers are going after the devices that guard company networks, and a new set of flaws could turn their control pages into an open door. A report from Eclypsium says flaws in firewalls, VPNs and similar equipment are already being exploited. Two newer PHP flaws, nicknamed PHP2Shell, add to the risk.
Eclypsium publishes a monthly report called InfraTrust Pulse that tracks security warnings for network devices and other infrastructure. Between September 18 and October 14, it counted 133 new advisories from 18 vendors. Of those, 37 were rated critical and 58 could be exploited remotely without a password. Sixteen covered flaws that attackers were already using.
PHP is a common programming language for websites. Many firewalls, VPNs, application delivery controllers (devices that spread web traffic across servers) and network storage boxes use it for the web page where administrators manage the device. Two PHP flaws let an outsider run code on such a system without logging in. The PHP project fixed them on October 21.
The catch is that vendors build PHP into the device software, called firmware. Owners cannot update PHP themselves. They must wait for the vendor to release new firmware. Palo Alto Networks, F5, NetScaler, Check Point and QNAP confirmed that some of their products are affected and said they were still working on fixes.
Any organization that runs these kinds of devices, especially ones facing the internet. Attackers like them because they sit at the edge of a network and can give a first way in, or a springboard for further attacks. A business with none of these devices has little to worry about here. One whose management pages cannot be reached from the internet is already doing what the report advises for now.
The alert box above lists the steps. The short version: keep management pages off the internet, and ask your IT provider which of your devices use these products. The report says to patch NetScaler and Ivanti Connect Secure first, because remote-access gateways can act as a doorway into a company network.
Still unknown is when each vendor will ship its fixed firmware. The report also does not say that PHP2Shell attacks are already underway. The flaws confirmed as exploited are others on its list. The same problem also shows up elsewhere. A Linux flaw called Copy Fail now appears in 29 advisories across eight vendors, up from 19 across six last month.
Make sure the management page of every firewall, VPN and storage device is not open to the internet, then patch as vendors release fixes.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
