Security News > 2022 > June > Linux botnets now exploit critical Atlassian Confluence bug
Several botnets are now using exploits targeting a critical remote code execution vulnerability to infect Linux servers running unpatched Atlassian Confluence Server and Data Center installs.
After proof-of-concept exploits were published online, cybersecurity firm GreyNoise said it detected an almost ten-fold increase in active exploitation, from 23 IP addresses attempting to exploit it to more than 200.
Kinsing has also targeted Confluence in the past using another critical Atlassian Confluence RCE flaw to install cryptomining malware after a PoC exploit was released online.
One day after this actively exploited bug was disclosed, Atlassian released security updates and urged customers to patch their installations to block ongoing attacks.
"We strongly recommend upgrading to a fixed version of Confluence as there are several other security fixes included in the fixed versions of Confluence," Atlassian said.
If you can't immediately upgrade your Confluence install, you can also use a temporary workaround that requires updating some JAR files on the Confluence server, as detailed here.
News URL
Related news
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits (source)
- Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) (source)
- Akira and Fog ransomware now exploit critical Veeam RCE flaw (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)