Security News
![Log4j RCE latest: In case you hadn't noticed, this is Really Very Bad, exploited in the wild, needs urgent patching](/static/build/img/news/log4j-rce-latest-in-case-you-hadn-t-noticed-this-is-really-very-bad-exploited-in-the-wild-needs-urgent-patching-small.jpg)
Miscreants are wasting no time in using the widespread Log4j vulnerability to compromise systems, with waves and waves of live exploit attempts focused mainly - for now - on turning infected devices into cryptocurrency-mining botnet drones. Apache Log4j is a logging utility written in Java that is used all over the world in many software packages and online systems.
![Critical RCE 0day in Apache Log4j library exploited in the wild (CVE-2021-44228)](/static/build/img/news/critical-rce-0day-in-apache-log4j-library-exploited-in-the-wild-cve-2021-44228-small.jpg)
A critical zero-day vulnerability in Apache Log4j, a widely used Java logging library, is being leveraged by attackers in the wild - for now primarily to deliver coin miners.Reported to the Apache Software Foundation by Chen Zhaojun of Alibaba Cloud Security Team, the bug has now apparently been fixed in Log4j v2.15.0, just as a PoC has popped up on GitHub and there are reports that attackers are already attempting to compromise vulnerable applications/servers.
![Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely-used logging utility](/static/build/img/news/log4j-rce-emergency-patch-issued-to-plug-critical-auth-free-code-execution-hole-in-widely-used-logging-utility-small.jpg)
An unauthenticated remote code execution vulnerability in Apache's Log4j Java-based logging tool is being actively exploited, researchers have warned after it was used to execute code on Minecraft servers. The Apache Foundation published a patch for the critical-rated vuln earlier today.
![Dark Mirai botnet targeting RCE on popular TP-Link router](/static/build/img/news/dark-mirai-botnet-targeting-rce-on-popular-tp-link-router-small.jpg)
The botnet known as Dark Mirai has been observed exploiting a new vulnerability on the TP-Link TL-WR840N EU V5, a popular inexpensive home router released in 2017. According to a report by researchers at Fortinet, who have been following Dark Mirai activity, the botnet added the particular RCE in its arsenal only two weeks after TP-Link released the firmware update.
![Windows 10 Drive-By RCE Triggered by Default URI Handler](/static/build/img/news/windows-10-drive-by-rce-triggered-by-default-uri-handler-1-small.jpg)
Researchers have discovered a drive-by remote code-execution bug in Windows 10 via Internet Explorer 11/Edge Legacy - the EdgeHTML-based browser that's currently the default browser on Windows 10 PCs - and Microsoft Teams. In this case, the issue lies in the Windows 10/11 default Uniform Resource Identifier handler for ms-officecmd: URIs are used by the Microsoft Office Universal Windows Platform app to launch other Office desktop applications.
![Windows 10 Drive-By RCE Triggered by Default URI Handler](/static/build/img/news/windows-10-drive-by-rce-triggered-by-default-uri-handler-small.jpg)
Researchers have discovered a drive-by remote code-execution bug in Windows 10 via Internet Explorer 11/Edge Legacy - the EdgeHTML-based browser that's currently the default browser on Windows 10 PCs - and Microsoft Teams. In this case, the issue lies in the Windows 10/11 default Uniform Resource Identifier handler for ms-officecmd: URIs are used by the Microsoft Office Universal Windows Platform app to launch other Office desktop applications.
![Exploit released for Microsoft Exchange RCE bug, patch now](/static/build/img/news/exploit-released-for-microsoft-exchange-rce-bug-patch-now-small.jpg)
Proof-of-concept exploit code has been released online over the weekend for an actively exploited high severity vulnerability impacting Microsoft Exchange servers.The security bug tracked as CVE-2021-42321 impacts on-premises Exchange Server 2016 and Exchange Server 2019 and was patched by Microsoft during this month's Patch Tuesday.
![Critical Root RCE Bug Affects Multiple Netgear SOHO Router Models](/static/build/img/news/critical-root-rce-bug-affects-multiple-netgear-soho-router-models-small.jpg)
Networking equipment company Netgear has released yet another round of patches to remediate a high-severity remote code execution vulnerability affecting multiple routers that could be exploited by remote attackers to take control of an affected system. Because of its ubiquitous nature, UPnP is used by a wide variety of devices, including personal computers, networking equipment, video game consoles and internet of things devices.
![Week in review: Critical RCE in Palo Alto Networks firewalls, how to select a DRaaS solution](/static/build/img/news/week-in-review-critical-rce-in-palo-alto-networks-firewalls-how-to-select-a-draas-solution-small.jpg)
Critical RCE in Palo Alto Networks firewalls revealed, patch ASAP!The existence of a critical RCE vulnerability affecting certain versions of Palo Alto Networks firewalls using the GlobalProtect Portal VPN has been revealed by a cybersecurity company that exploited it during red team engagements for the last 12 months. Vulnerabilities in Nucleus NET TCP/IP stack could lead to real-world damageResearchers have unearthed 13 vulnerabilities affecting the Nucleus NET TCP/IP stack and have demonstrated how attackers could exploit them to cause serious real-world damage.
![Critical RCE in Palo Alto Networks (PAN) firewalls revealed, patch ASAP! (CVE-2021-3064)](/static/build/img/news/critical-rce-in-palo-alto-networks-pan-firewalls-revealed-patch-asap-cve-2021-3064-small.jpg)
The existence of a critical RCE vulnerability affecting certain versions of Palo Alto Networks firewalls using the GlobalProtect Portal VPN has been revealed by a cybersecurity company that exploited it during red team engagements for the last 12 months. The vulnerability has been patched, but since there are still over 10,000 vulnerable internet-facing installations out there, Randori will refrain from publishing technical details related to the vulnerability for a month, to give affected organizations enough time to patch.