WordPress plugin vulnerability affects over 5 million sites.

Summary

By the CyberWire staff

At a glance.

WordPress plugin vulnerability affects over 5 million sites.
Google patches Chrome zero-day.
US Justice Department charges alleged member of the Karakurt ransomware group.

WordPress plugin vulnerability affects over 5 million sites.

A patch has been issued for a critical privilege escalation flaw affecting the LiteSpeed Cache plugin for WordPress sites, Infosecurity Magazine reports. LiteSpeed Cache is the most popular caching plugin for WordPress, with more than 5 million installations. Patchstack has published a report on the vulnerability, stating, "The plugin suffers from an unauthenticated privilege escalation vulnerability which allows any unauthenticated visitor to gain Administrator level access after which malicious plugins could be uploaded and installed. The vulnerability exploits a user simulation feature in the plugin which is protected by a weak security hash that uses known values."

Security researcher John Blackbourn discovered the flaw and was awarded $14,400 through the Patchstack Zero Day bug bounty program, which Patchstack notes is "the highest bounty in the history of WordPress bug bounty hunting."

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

Google patches Chrome zero-day.

Google yesterday issued an emergency security patch for an actively exploited zero-day flaw affecting Chrome, BleepingComputer reports. The vulnerability (CVE-2024-7971) is a "[t]ype confusion in V8 in Google Chrome prior to 128.0.6613.84 [that] allowed a remote attacker to exploit heap corruption via a crafted HTML page." Google has declined to share details on the flaw until more users have had a chance to apply the fix. Chrome will automatically install the patch when users relaunch their browsers.

See what cybercriminals know about your organization and customers

Digital identities go beyond just usernames and passwords, meaning cybercriminals have increased access to sensitive data they can use against you. Last year alone, SpyCloud researchers and data scientists recaptured and analyzed more than 43.7 billion distinct identity records. Use our free tool to see your organization’s darknet footprint, including breach exposures and malware-exfiltrated data that put your business at risk of account takeover and ransomware. Check your exposure now.

US Justice Department charges alleged member of the Karakurt ransomware group.

The US Justice Department has charged a Latvian man who lived in Russia for his alleged participation in the Karakurt ransomware group. The defendant, 33-year-old Deniss Zolotarjovs, was arrested in Georgia last year and extradited to the US this month. The Justice Department stated, "According to court documents, Zolotarjovs is a member of a known cybercriminal organization that attacks computer systems of victims around the world. Among other things, the Russian cybercrime group steals victim data and threatens to release it unless the victim pays ransom in cryptocurrency. The group maintains a leaks and auction website that lists victim companies and offers stolen data for download. It is alleged that Zolotarjovs was an active member of the Russian cybercrime group, communicating with other members, laundering cryptocurrency received from victims, and extorting victims."

DMV Rising, D.C.’s Premier Conference for Cyber Execs.

The Washington, D.C. Maryland, and Virginia (DMV) region has established itself as a top-tier player in the global cyber industry. Join us on September 12, 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Notes.

Today's issue includes events affecting Latvia, Russia, and the United States.

Sponsored Events

Upcoming Cyber Security Summits (Multiple Cities, Aug 20 - Sep 6, 2024) Join us In-Person and network over breakfast, lunch & a cocktail reception on 8/20 in Detroit, 8/22 in Portland, 8/27 in San Antonio and 9/6 in Chicago! Learn about the latest threats and solutions from The FBI, U.S. DHS/CISA, City of Detroit, City of Chicago & more. Earn CPE/CEU credits with your attendance. Get 50% off admission w/ code CSS24-CYBERWIRE at CyberSecuritySummit.com (Only $125 with code)

Upcoming webinar: Unpacking the 2024 Ransomware Landscape (Virtual, Aug 22, 2024) Join David Bittner and Deepen Desai, Chief Security Officer at Zscaler, on August 22nd for an exclusive deep dive into the latest findings from the Zscaler ThreatLabz 2024 Ransomware Report. In this discussion, we will highlight critical insights into the most targeted industries and regions, uncover the dynamics behind a record ransom payout, discuss emerging ransomware families to watch, and share predictions for the upcoming year. Register now to secure your spot.

DMV Rising, D.C.’s Premier Conference for Cyber Execs. (Virtual and Washington, DC, US, Sep 12, 2024) The Washington, D.C. Maryland, and Virginia (DMV) region has established itself as a top-tier player in the global cyber industry. Join us on September 12, 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

ISC2 Security Congress 2024 (Virtual / Las Vegas, NV, US, Oct 14 - 16, 2024) Join us at ISC2 Security Congress, October 14-16 in Las Vegas or online. Connect with global cyber experts, hear from four keynote speakers, and participate in one of eight pre-conference workshops. Discover cutting-edge insights and advance your skills in cybersecurity. Don’t miss out!

Step into the heart of excitement at the Finance & Accounting Technology Expo! (New York, NY, Oct 29 - 30, 2024) FATE is the leading expo in the finance industry, bringing together experts, innovators, and professionals like yourself to connect, explore and expand! There will be over 70 technologies, more than 60 learning sessions, incredible networking with over 1000 finance and accounting professionals -- and great keynote speakers. Our keynote speakers range from Shark Tank Judge Daymond John to CFO Glenn Hopper and even a TechStack of Sports panel, bringing you CFOs of some of the most recognized brands in sports sharing how technology powers their decisions and their growth! This premier event will leave you with the latest insights, strategies, and tools necessary to excel in the dynamic landscape of finance, accounting, and technology. And the best part is that – it's FREE! Use Code: wko735 and reduce your ticket price to $0. Register here today!

Selected Reading

Attacks, Threats, and Vulnerabilities

Slack AI can leak private data via prompt injection (The Register) Whack yakety-yak app chaps rapped for security crack

Security Patches, Mitigations, and Software Updates

Cisco Patches High-Severity Vulnerability Reported by NSA (SecurityWeek) A high-severity vulnerability in Cisco Unified CM and Unified CM SME could allow attackers to cause a denial-of-service (DoS) condition.

Technologies, Techniques, and Standards

ASD’s ACSC, CISA, FBI, and NSA, with the support of International Partners Release Best Practices for Event Logging and Threat Detection | CISA (Cybersecurity and Infrastructure Security Agency CISA)

Legislation, Policy, and Regulation

FAA proposes new cybersecurity rules for airplanes (The Record) The Federal Aviation Administration unveiled a proposal this week for new rules governing the cybersecurity of airplanes, engines and propellers as they are increasingly designed to be connected to both internal and external data networks that could make them vulnerable to cyber threats.

Litigation, Investigation, and Law Enforcement

Man sentenced for hacking state registry to fake his own death (BleepingComputer) A 39-year old man from Somerset, Kentucky, was sentenced to 81 months in federal prison for identity theft and faking his own death in government registry systems.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Unpacking the 2024 Ransomware Landscape: Insights and Strategies from ThreatLabz (Virtual, Aug 22, 2024) This live discussion on the latest findings from the Zscaler ThreatLabz 2024 Ransomware Report highlights the most targeted industries and regions, the dynamics behind a ransom payout, emerging ransomware families, and predictions for 2025. Register now.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Jailbreak Brewing Company Security Summit (Laurel, Maryland, USA, Sep 6, 2024) Join some of the world's best security researchers as they talk about disinformation; the misleading and deliberate deception in today's connected world, both from the technical and policy sides at the only computer security event held at a production brewery. Attendance is limited to 150 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and an awesome time to chat with fellow security experts. Come participate in the talks, the conversation, and the beer!

DMV Rising 2024 (Washington, DC, Sep 12, 2024) DMV Rising is D.C.'s premier cybersecurity event, bringing together cybersecurity executives to tackle tough problems, share new insights, and explore innovative solutions emerging in D.C., Maryland, and Virginia.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 08.22.24

At a glance.

WordPress plugin vulnerability affects over 5 million sites.

Google patches Chrome zero-day.

US Justice Department charges alleged member of the Karakurt ransomware group.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Technologies, Techniques, and Standards

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events