OpenSSH regreSSHion Vulnerability; Juniper Releases Patches for Critical Session Smart Router Flaw; Threat Actor are Targeting EoL D-Link Routers

Researchers at Qualys have published details about a critical unauthenticated remote code execution vulnerability in OpenSSH server. The flaw could be exploited to execute code as root on Linux systems. The problem is due to a signal handler race condition. There are two associated CVEs because the issue Qualys identified (CVE-2024-6387) is a regression of a vulnerability (CVE-2026-5051) that was patched nearly 18 years ago.

Juniper Networks has released an out-of-cycle software update to address a critical authentication bypass vulnerability in Session Smart Router, Session Smart Conductor, and WAN Assurance Router running in high-availability redundant configurations. Users are urged to apply updates as soon as possible.

Researchers at GreyNoise say that threat actors are targeting unsupported D-Link routers via a path traversal vulnerability (CVE-2024-0769) that was disclosed in January 2024. At that time, the National Institute of Standards and Technology's (NIST's) National Vulnerability Database (NVD) noted that the affected products were unsupported when [the CVE was] assigned. Users are urged to replace affected products with newer, supported products.

Cisco has released updates to address an OS command injection vulnerability in the CLI of Cisco NX-OS Software. The issue is due to insufficient validation of arguments passed to certain configuration CLI commands. Exploitation of the flaw requires admin credentials; an authenticated local attacker could execute arbitrary commands.

The advisory includes a list of affected products as well as a list of products that are confirmed not to be affected. Cisco was alerted to the vulnerability (CVE-2024-20399) by researchers from Sygnia.

The US Federal Communications Commission has released drafted final rules for bolstering the cybersecurity of the country's emergency alert and warning systems. The rules would apply to both the US Emergency Alert System, which broadcasts warnings on radio and television, and the US Wireless Emergency Alert system, which sends warnings to cell phones. The rules would require communications providers with emergency alert systems to develop and implement cybersecurity risk management plans, and to have contingency plans for broadcasting warnings.

Following the June 20 ransomware attack on Indonesia's national data center, Indonesian president Joko Widodo has ordered an audit of the country's data centers following the revelation that most of the information stored at the targeted data center was not backed up. While backup services were available, they were optional, not mandatory.

Australian law enforcement authorities have charged one person with nine counts of various cybercrimes for allegedly setting up phony WiFi access points at airports and on domestic flights with the intent of stealing account credentials. The 'evil twin' access points were created to resemble legitimate networks, and required users to sign in to email and social media accounts. The access credentials were then allegedly saved to the suspect's devices.

Researchers at Malwarebytes have detected a malware campaign that targets macOS systems through malicious Google ads for the Arc browser. The campaign drops an information stealer that exfiltrates account passwords, VPN configurations, and other data.

Microsoft is notifying more Office 365 customers that their email messages may have been compromised by threat actors known as Midnight Blizzard. Affected customers received communication from Microsoft that says, 'You are receiving this notification because emails were exchanged between Microsoft and accounts in your organization, and those emails were accessed by the threat actor Midnight Blizzard as part of their cyber-attack on Microsoft.' Some of the recently notified customers were aware their emails were compromised; to others, Microsoft's notification was the first time heard that their messages had been stolen.

Chicago's Lurie Children's Hospital has filed updated incident notices with several state regulators regarding the January 2024 cyberattack that disrupted services for months. Lurie's most recent disclosures indicate that the incident compromised sensitive information belonging to nearly 800,000 people. New Jersey-based Prudential Financial has filed an updated incident notice about a February 4 breach. Initially, Prudential said that the incident affected more than 36,000 individuals; the revised notice places the number of affected individuals at 2.56 million.