Code Execution Flaws in PHP

The PHP community has released updates to PHP in order to patch multiple vulnerabilities in one of the most popular programming languages.

According to the Hacker News, "The vulnerabilities could leave hundreds of thousands of web applications that rely on PHP open to code execution attacks, including websites powered by some popular content management systems such as WordPress, Drupal, and TYPO3" (https://thehackernews.com/2019/09/php-programming-language.html).

Out of all these vulnerabilities, the most critical one was found in the Oniguruma library that comes bundled with PHP.

Red Hat released an advisory stating that the vulnerability "allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing crafted regular expressions" (https://access.redhat.com/security/cve/cve-2019-13224).

If your projects use PHP, please update immediately.

ESET Finds Malware That Targets Political Activists

Researchers at ESET have discovered an unreported malware dubbed Win32/StealthFalcon that exploits the Windows component Background Intelligent Transfer Service (BITS, https://www.zdnet.com/article/newly-discovered-cyber-espionage-malware-abuses-windows-bits-service/).

BITS is used by software updaters, messengers, and other services and applications that need to transfer a large amount of data without chomping on network bandwidth, like when a user is not using the machine.

According to ESET Research, "The Win32/StealthFalcon backdoor, which appears to have been created in 2015, allows the attacker to control the compromised computer remotely" (https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/).

The malware was created by Stealth Falcon, a notorious threat group that targets political activists and journalists in the Middle East.

Bluetooth Vulnerability Makes Spying Easy

Bluetooth is one of the weakest links that opens doors for attacks. A newly discovered vulnerability in Bluetooth enables bad actors to spy on data flowing between two devices (https://thehackernews.com/2019/08/bluetooth-knob-vulnerability.html).

According to the Hacker News, "The vulnerability, assigned as CVE-2019-9506, resides in the way 'encryption key negotiation protocol' lets two Bluetooth BR/EDR devices choose an entropy value for encryption keys while pairing to secure their connection."

The vulnerability exposes billions of smartphones, laptops, and industrial devices.

There is nothing users can do to protect themselves at this time. According to an advisory by Carnegie Mellon University (https://www.kb.cert.org/vuls/id/918987/), Bluetooth host and controller suppliers should refer to the Bluetooth SIG's "Expedited Errata Correction 11838" for guidance on updating their products. Downstream vendors should refer to their suppliers for updates.