Security alerts and urgent notes on vulnerabilities that affect websites and servers, with what to do now.
Alerts ·
On Alpine Linux servers with the standard openssh-server package, attackers can log in to accounts without a password, such as key-only accounts. OpenSSH 10.6p2 and updated Alpine packages fix it.
Alerts ·
A flaw in APT lets an attacker who can modify package downloads replace a verified package and run code as root. Debian and Ubuntu published advisories on November 4. Update APT on all servers.
Alerts ·
A critical flaw in Ruby on Rails Active Storage lets unauthenticated attackers write arbitrary files on the server through a crafted upload when ImageMagick processes it. Update to Rails 8.1.4.1 or 8.0.5.2.
Alerts ·
Two newly disclosed Xen flaws let a malicious guest access the memory of other VMs, including dom0. All versions since 4.6 are affected and there is no mitigation, so hosts need to be patched.
Alerts ·
Five WordPress plugins have newly disclosed high-severity flaws, among them LiteSpeed Cache with 7 million installations and GiveWP. Here is what is affected and what to update.
Alerts ·
On November 2 an attacker used cPGuard's update system to push a script to customer servers. The script installed a backdoor and collected password hashes and files. Servers running cPGuard should be checked now.
Alerts ·
Six WordPress plugins have newly disclosed vulnerabilities, including SureCart, Ultra Addons for Contact Form 7 and s2Member. Two flaws are rated CVSS 9.8, and three allow account takeover or file deletion.
Alerts ·
Two critical flaws in Langflow allow attackers to bypass authentication or run arbitrary code without an account. All releases from 1.0.0 to 1.12.8 are affected. Version 1.13.0 fixes both.
Alerts ·
An authentication bypass in Barracuda Email Security Gateway before 9.4.0.030 lets unauthenticated attackers import a crafted backup and change the appliance's global configuration. Update to 9.4.0.030 or later.
Alerts ·
The BTCPay Server maintainer warns that attackers are draining hot wallets on instances running older releases. Operators of self-hosted instances should update to the latest version now and check their wallets.
Alerts ·
Progress has reported several critical vulnerabilities in WS_FTP that can lead to compromise of the server. Administrators should install the vendor updates soon.
Alerts ·
A CVSS 10.0 flaw in Canonical LXD and MicroCloud lets an attacker with network access to the HTTPS API log in as a trusted client without its private key, gaining access to the cluster and its VMs.
You came through a link of one of our partners. With your consent we remember this in a cookie for 90 days, so the person who recommended us receives their commission even if you sign up later. It costs you nothing.
Privacy policyThese are all cookies and browser entries we use on centoculus.com and app.centoculus.com. We use no analytics or advertising cookies and load no third-party services. Necessary cookies keep forms and sign-in working; partner attribution is only set with your consent.
These cookies and entries are needed to run the website and the service and cannot be switched off. They are not used for advertising or analytics.
Remembers the code of the partner whose link you came through for 90 days. If you sign up within this time, your account is assigned to that partner and they receive a commission. Without consent only the code in the address or a promo code you enter yourself counts.
You can change or withdraw your choice at any time under "Cookie settings" at the bottom of every page. Privacy policy
