What to do about this week’s attacks
-
Ask anyone who runs a website for you to confirm it's on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version.
Two critical PHP flaws now have a fix. Some firms report early attacks -
Update every Plex Media Server in the family to 1.43.3.10861 or newer, and turn off Remote Access if nobody watches from outside the house.
Plex Media Server under attack: update to 1.43.3.10861 or newer now -
Ask whoever runs servers for you (the family office, a business, the person who set up a home server or NAS) whether they run Linux, and to install the fixed kernel and reboot as soon as their distribution ships it.
Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet -
If anyone in the family connected a crypto wallet to a DeFi site on 30 or 31 October, check and revoke its approvals at revoke.cash, and move what's left to a fresh wallet if they signed anything.
Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer
How people are being hacked this week
-
ChatGPT: opening someone's shared chat could hand them your private ones, until a fix on 26 October
WatchPeople pretending · Situation Room ·
Researchers found that opening a booby-trapped shared ChatGPT link could let its maker read your private chats and act as you.
-
Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet
HighYour devices · Situation Room ·
A Linux flaw rated 9.8 could let someone on the internet take over a server before it even answers.
-
Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer
HighWhat reaches you · Situation Room ·
On 30 October, attackers took over 12 crypto sites registered with Name.com, 10 of them through Vercel.
-
Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it
HighWhat’s already out there · Updated ·
Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted.
-
Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record
HighWhat’s already out there · Situation Room ·
Attackers took about US$6.3 billion from Binance on 29 October, the biggest crypto theft ever.
-
Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users
WatchWhat’s already out there · Situation Room ·
Scribd, which also runs Everand, SlideShare and Fable, says intruders reached user data.
Attackers find more flaws every month
Have HARD watch your family’s devices
-
The app
Watches all four ways on your Mac, iPhone and browser, and steps in before a scam can move money. For you, your family and the parents you look after. From US$4 a month.
-
HARD Engineer
A named senior engineer for your household, on call at any hour, who secures every home’s network and picks up when the app can’t. US$2,750 a month, by introduction.