Daily Threat Brief.

The last 24 hours

Today is deadline day. The WordPress flaw attackers are using (fixed in version 7.1.4) reaches its federal patch deadline, and a critical flaw in Veeam backup software version 13 should be fixed today. A campaign that signs in to Microsoft 365 as connected apps, using app passwords and secrets accidentally published online, is still active. Because no person is signing in, there's no multi-factor prompt to stop it. Nothing new was added overnight to CISA's list of exploited flaws, and Microsoft's monthly security updates arrive Tuesday, November 10.

Do three things

1. Review apps connected to Microsoft 365 Remove apps you no longer use and replace app passwords on the ones you keep.
2. Confirm your website is on WordPress 7.1.4 Get written confirmation from your web host or developer, plus a check for signs of a past break-in.
3. Plan for Patch Tuesday, Nov 10 Microsoft's monthly fixes arrive Tuesday. Let computers restart within a few days of that.

What's happening

• Microsoft 365 break-ins through connected apps

  An attacker is signing in to Microsoft 365 as the apps connected to it, using stolen app passwords, many of them accidentally published on GitHub, a public code-sharing site. This isn't a Microsoft bug, so there's no patch. The defense is checking sign-in logs for app sign-ins, removing unused apps and replacing app passwords.

• WordPress websites, deadline today

  A WordPress flaw on CISA's list of flaws used in real attacks (CISA is the U.S. government's cybersecurity agency) scores 8.1 out of 10 and is fixed in version 7.1.4. Site owners should also look for signs of a past break-in, and hosting companies that update automatically should confirm it in writing.

• Veeam backup software version 13

  A 9.1-out-of-10 flaw lets an attacker get around sign-in on Veeam Backup & Replication 13. Fixed versions are out, version 12 isn't affected, and it isn't known to be used in attacks yet. Backup servers should never be reachable from the internet.

• Linux servers

  A fix for apt, the tool Ubuntu and Debian servers use to install updates, came out Nov 4; automatic updates should have applied it, but it's worth confirming. A 9.8-out-of-10 Linux kernel flaw is still waiting on a regular Ubuntu fix. Neither is known to be used in attacks.

• Refrigeration and cold-storage controllers

  The FBI and CISA warned that attackers are going after temperature controllers for refrigerators and cold storage that can be reached from the internet. Any controller for medication, vaccine or food storage should be taken off the public internet and updated.

• Fake AI event invitations

  Invitations to fake OpenAI, SpaceX and Anthropic events are being used to steal Microsoft and Google accounts. Confirm any event invitation another way before signing in through it.

• Old Apple devices

  An old Apple flaw now on CISA's exploited list affects only iPhones, iPads and Macs never updated past the May 2024 releases (iOS 17.5, macOS Sonoma 14.5). Update or retire those devices by Nov 18.

• Only if you have this equipment

  SonicWall GMS management software is no longer supported and won't be fixed, so replace it. Ivanti Connect Secure VPNs need a fix by Nov 13. Zyxel GS1900 switches need firmware 2.90 Patch 3.

What to ask your IT provider

1. Have the apps connected to our Microsoft 365 been reviewed, with unused ones removed and app passwords replaced?
2. Has whoever maintains our website confirmed in writing that it's on WordPress 7.1.4 and checked it for signs of a break-in?
3. If we run Veeam version 13, is it on a fixed version as of today?
4. Do we have any iPhones, iPads or Macs that can't be updated, and what's the plan for each?
5. Is time set aside to install Microsoft's updates after Tuesday, Nov 10?

Coming up

• Nov 10 Microsoft Patch Tuesday
• Nov 11 federal deadline for the VMware ESX flaw
• Nov 13 federal deadline for the Ivanti Connect Secure flaw
• Nov 18 federal deadline for the old Apple flaw