IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Weekly threat roundup: Chrome, Citrix and WordPress

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Google Chrome Zero-day under active exploitation  

The latest stable channel update for the desktop installation of the Chrome web browser has seen Google fix several high-risk vulnerabilities and one medium-risk vulnerability, numbering five in total

The highlight of the five patches includes the heap buffer overflow in FreetType flaw, tagged CVE-2020-15999 and rated ‘high’, which is a zero-day flaw which attackers are actively exploiting. FreeType is a widely used software development library that’s also a Chrome component, and the bug in this font rendering library affects the browser on Windows, macOS as well as Linux.

Privilege escalation flaws in Citrix VPN

The Citrix Gateway Plug-In for Windows, a widely used business-oriented virtual private network (VPN), is embedded with multiple escalation of privilege flaws, according to cyber security researchers from Cymptom

Tagged as CVE-2020-8257 and CVE-2020-8258, these two vulnerabilities lie in the way the Citrix Gateway Service runs as SYSTEM, and executes a periodic PowerShell script every five minutes, also executed as SYSTEM. As powershell.exe is invoked in file name only, Windows searches through multiple directories to find it. Hackers could exploit this by creating a malicious file, naming it powershell.exe, and copying it into every directory they have access to, which would allow them to achieve elevation of privileges on systems running Citrix Gateway Plug-In for Windows.

VMware software breaking Cisco HyperFlex clusters

This week Cisco warned HyperFlex users that a VMware coding bug in vCenter Server 7.0 U1may leave their hyperconverged infrastructure installations in an ‘unrecoverable’ state.

The bug, which affects HyperFlex controllers managed by the vCenter ESX Agent Manager (EAM) service, causes affected HyperFlex clusters to encounter an issue where HyperFlex controller VMs suddenly power off and are deleted. This results in the loss of cluster availability, and sometimes can even render the HyperFlex storage cluster “unrecoverable”. 

There are no workarounds available at this time, with cisco recommending that customers do not use vCenter 7.0 GA or vCenter 7.0 U1 until they are qualified and listed as a supported combination in the HyperFlex Data Platform release notes. 

KashmirBlack botnet hitting CMS platforms

The existence of one of the most sophisticated active botnets was disclosed this week, with researchers detailing how KashmirBlack, as it’s called, has compromised hundreds of thousands of systems to attack content management systems (CMS).

Spread across 30 countries, and conducting millions of attacks each day, this botnet exploits a decade-old PHPUnite remote code execution flaw to attack CMS platforms, mainly due to their generally poor cyber hygiene. 

This particular flaw is known and patchable, but the botnet has capitalised on the surge in the companies disrupted by coronavirus, which now require easy-to-use web frameworks to move their business online. This includes well-known platforms like WordPress.

Address spoofing bug hits widely-used mobile browsers

Several popular mobile web browsers, including Safari and Opera Touch, are susceptible to exploitation due to a web address spoofing bug that could allow hackers to perform spear-phishing attacks, or deploy malware.

The vulnerability could allow an attacker to set up a malicious website and tempt a victim into opening a link from a spoofed email or text message. This would then lead the user to a malicious site disguised as a legitimate site, on which they could download a malicious file, or hand over personal information.

The origin lies in the way a hacker could execute malicious JavaScript code on this website to force the browser to update the address bar to another address of the attacker’s preference, all while the page loads.

Emergency WordPress patch for SQL injection attack

The Loginizer security plugin for WordPress, which has more than a million active installations, was forcibly patched by the CMS platform this week after WP Deeply researchers disclosed a dangerous vulnerability.

The plugin, which protects sites from brute force attacks, was afflicted with an SQL injection bug that could have allowed hackers to seize control of users’ WordPress sites. This severe vulnerability lies in the plug-in’s core brute force protection mechanism, and can be exploited by a hacker who logs into a WordPress site using a malformed username, in which they include SQL statements. 

Upon failed authentication, Loginizer will record this failed attempt in the site’s database, along with the failed username, however, the plugin doesn’t wipe the username and leaves the SQL statements intact. This opens the door for attackers to run code against the database remotely, and compromise the site.

Ryuk ransomware strikes again - targeting French IT giant

Hackers linked with the Ryuk ransomware group have attacked the IT services firm Sopra Steria, although the French company has revealed few little details around the nature or scale of the cyber attack.

The company runs a joint venture with the UK’s Department of Health and Social Care to offer services such as accounting, payroll and managed IT to NHS organisations. It’s unclear whether any of these services have been disrupted as a result of the attack, although French media have claimed the Ryuk malware strain is to blame. Other organisations are being warned to stay alert with regards to the ongoing disruptive threat that ransomware poses.

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download


Best free malware removal tools 2022

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide

CIAM buyer’s guide

6 Jun 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022
Salaries for the least popular programming languages surge as much as 44%

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022