Actively exploited flaws pile up: patch your internet-facing servers

Unauthorized access incidents continued in Japan this week, and flaws in NextCloud's built-in Collabora server and Arista VeloCloud are being exploited in the wild. A fix for a serious PHP vulnerability was also released, and a warning was issued about SafePay ransomware targeting VPNs. Web agencies and small operators running public servers, APIs or internal tools should review them this week.

Key stories

1. 1
   RED FLAG

   Japan breach wave: JPCERT/CC adds AI-driven pen-test tool attacks

   Attackers use varied methods, including API abuse, a Metabase flaw and web shells, and internal systems are targeted too. Operators with public APIs or BI tools should check them now.

2. 2
   RED FLAG

   Collabora Online built-in CODE server in NextCloud exploited for remote code execution

   The flaw in NextCloud's built-in Collabora CODE server is confirmed exploited and could lead to server takeover. Updating to the fixed version is the top priority.

3. 3
   DOUBLE YELLOW FLAG

   Japan's internal affairs minister urges prompt PHP updates over a serious flaw

   The serious PHP flaw could allow unauthorized code execution and site outages. Many sites run on PHP, and users of end-of-support versions need to migrate.

4. 4
   RED FLAG

   Arista VeloCloud Orchestrator (on-prem) SQL injection exploited in the wild

   On-prem VeloCloud Orchestrator is confirmed exploited and the management server could be taken over. Affected firms need to update and stop exposing the admin interface.

5. 5
   YELLOW FLAG

   SafePay ransomware targets VPNs and exposed devices; check defenses now

   SafePay has hit about 600 victims, exploiting VPNs and exposed devices and wiping backups. Multi-factor authentication and offline backups are essential.

6. 6
   YELLOW FLAG

   Studio breach may have leaked Digital Agency inquiry form data

   Unauthorized access to Studio's cloud environment may have leaked inquiry content. Studio users should confirm whether their own data is affected.

Your checklist

• Check the versions of PHP, NextCloud and VeloCloud in use and update to fixed releases.
• Until you can update, restrict external access to NextCloud's built-in CODE server and the VeloCloud admin interface.
• If you use Metabase, update it and review access restrictions on APIs and admin pages.
• Update firmware on VPNs and other exposed devices and require multi-factor authentication.
• Keep offline backups and test restoring them.
• Check server logs for access from suspicious IPs and for suspicious processes.
• If you use Studio, read the first notice and change your password.

Summarised by AI from this week's 16 stories.