Tumblr h as fixed Vulnerability-related.PatchVulnerability a vulnerability that it says could have exposed private user data , according to an announcement by the microblogging and social networking site . The information that could h ave been viewed Attack.Databreach by unauthorized parties includes email addresses , hashed and salted passwords , locations , previously used email addresses , and last login IPs . The flaw r esided in Vulnerability-related.DiscoverVulnerability the “ Recommended Blogs ” feature in the desktop version of Tumblr . The widget shows logged-in users a list of blogs that may be of interest to them . “ If a blog appeared in the module , it was possible , using debugging software in a certain way , to view certain account information associated with the blog , ” said Tumblr . D iscovered and reported Vulnerability-related.DiscoverVulnerability through the platform ’ s bug bounty program several weeks ago , the security vulnerability w as resolved Vulnerability-related.PatchVulnerability within 12 hours . The New York-based company also said that it couldn ’ t determine which specific accounts were at risk , although its analysis is said to have shown that “ the bug was rarely present ” . The site , which has over 440 million blogs , gave assurances to its users that it has found no evidence to suggest that any data was actually lifted . At the same time , the platform said that users needn ’ t take any action . In these cases , “ taking action ” usually means “ Change your passwords ! ” Nevertheless , the company ’ s decision to d isclose Vulnerability-related.DiscoverVulnerability the flaw is because of what Tumblr says is its commitment to transparency and because it believes that “ it ’ s simply the right thing to do ” . It has also taken steps to “ improve monitoring and analysis procedures to help it i dentify Vulnerability-related.DiscoverVulnerability and f ix Vulnerability-related.PatchVulnerability any similar bugs in the future ” . Tumblr has joined the ranks of other high-profile technology companies , such as Twitter , Facebook and Google , that h ave all revealed Vulnerability-related.DiscoverVulnerability vulnerabilities in recent weeks that could have b een exploited, Vulnerability-related.DiscoverVulnerability or were actually e xploited, Vulnerability-related.DiscoverVulnerability for h arvesting Attack.Databreach the private information of some users . Back in 2016 , Tumblr had its hands full with a security incident that c ompromised Attack.Databreach the details of 65 million Tumblr users as a result of a breach Attack.Databreach dating back to 2013 .

WordPress 5.0 users are being urged to u pdate Vulnerability-related.PatchVulnerability their CMS software to f ix Vulnerability-related.PatchVulnerability a number of serious bugs . The update ( WordPress 5.0.1 ) a ddresses Vulnerability-related.PatchVulnerability seven flaws and w as issued Vulnerability-related.PatchVulnerability Thursday , less than a week after WordPress 5.0 w as released. Vulnerability-related.PatchVulnerability The most serious of the flaws is a bug that allows the WordPress “ user activation screen ” to be indexed by Google and other search engines , leading to the possible public exposure of WordPress usernames and passwords . “ The user activation screen could be indexed by search engines in some uncommon configurations , leading to exposure of email addresses , and in some rare cases , default generated passwords , ” wrote security firm Wordfence in a blog post outlining the flaws . Wordfence s aid Vulnerability-related.DiscoverVulnerability all WordPress users running versions of the 4.x branch of WordPress core a re also impacted Vulnerability-related.DiscoverVulnerability by similar issues . It urges those 4.x users , not ready to update to the 5.0 branch , to i nstall Vulnerability-related.PatchVulnerability the WordPress 4.9.9 security update ( also r eleased Vulnerability-related.PatchVulnerability this week ) , which a ddresses Vulnerability-related.PatchVulnerability similar bugs . Three of the bugs f ixed Vulnerability-related.PatchVulnerability with the release of WordPress 5.0.1 are cross-site scripting ( XSS ) vulnerabilities . Two of the XSS bugs could allow for an adversary to launch a privilege escalation attack . “ Contributors could edit new [ WordPress web-based ] comments from higher-privileged users , potentially leading to a cross-site scripting vulnerability , ” Wordfence wrote . “ This is another vulnerability that requires a higher-level user role , making the likelihood of widespread exploitation quite low . WordPress a ddressed Vulnerability-related.PatchVulnerability this issue by removing the < form > tag from their HTML whitelist. ” WordPress plugins a re potentially impacted Vulnerability-related.DiscoverVulnerability by a third XSS bug that opens up sites to attacks launched by adversaries who send specially crafted URLs to affected sites . According to researchers , the bug d oesn’t impact Vulnerability-related.DiscoverVulnerability WordPress 5.0 directly , rather the “ wpmu_admin_do_redirect ” function used by some WordPress plugins . “ Specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances , ” they said . A PHP ( Hypertext Preprocessor ) bug w as also identified Vulnerability-related.DiscoverVulnerability by WordPress . This bug is more technical in nature and w as found Vulnerability-related.DiscoverVulnerability by Sam Thomas , of Secarma Labs , who p ublicly disclosed Vulnerability-related.DiscoverVulnerability it at the 2018 Black Hat conference . “ This vulnerability allows an author to assign an arbitrary file path to an attachment . The file path supplied by the author uses the phar : // stream wrapper on a previously uploaded attachment which leads to object injection utilizing a “ feature ” of the PHAR file type which stores serialized objects in the metadata of the PHAR file , ” wrote Wordfence . WordPress is also warning users of a unauthorized file deletion bug and an unauthorized post creation bug .

For years , researchers , hackers , and even some politicians h ave warned Vulnerability-related.DiscoverVulnerability about stark vulnerabilities in a mobile data network called SS7 . These flaws allow attackers to listen to calls , i ntercept Attack.Databreach text messages , and pinpoint a device 's location armed with just the target 's phone number . Taking advantage of these issues has typically been reserved for governments or surveillance contractors . But on Wednesday , German newspaper The Süddeutsche Zeitung reported that financially-motivated hackers had used those flaws to help d rain Attack.Databreach bank accounts . This is much bigger than a series of bank accounts though : it cements the fact that the SS7 network poses a threat to all of us , the general public . And it shows that companies and services across the world urgently need to move away from SMS-based authentication to protect customer accounts . `` I 'm not surprised that hackers take money that is 'lying on the table ' . I 'm just surprised that online bank thieves took so long in joining spying contractors in abusing the global SS7 network , '' Karsten Nohl , a cybersecurity researcher who h as highlighted Vulnerability-related.DiscoverVulnerability vulnerabilities in SS7 , told Motherboard in an email . In short , the issue with SS7 is that the network believes whatever you tell it . SS7 is especially used for data-roaming : when a phone user goes outside their own provider 's coverage , messages still need to get routed to them . But anyone with SS7 access , which can be purchased for around 1000 Euros according to The Süddeutsche Zeitung , can send a routing request , and the network may not authenticate where the message is coming from . That allows the attacker to direct a target 's text messages to another device , and , in the case of the bank accounts , s teal Attack.Databreach any codes needed to login or greenlight money transfers ( after the hackers o btained Attack.Databreach victim passwords ) . Although some telcos have taken steps to m itigate Vulnerability-related.PatchVulnerability the issue , there are clearly still huge gaps for hackers to exploit . `` Everyone 's accounts protected by text-based two-factor authentication , such as bank accounts , are potentially at risk until the FCC and telecom industry f ix Vulnerability-related.PatchVulnerability the devastating SS7 security flaw , '' Lieu said in a statement published Wednesday . `` I urge the Republican-controlled Congress to hold immediate hearings on this issue . '' In the meantime , and maybe irrespective of whether SS7 problems are ever f ixed, Vulnerability-related.PatchVulnerability social media companies , banks , and other online services need to stop using SMS-based two-factor authentication . Last year the National Institute of Standards and Technology said it was no longer recommending solutions that used SMS . Twitter does let users sign in with a code from Google Authenticator , an app on your smartphone that provides a more robust form of two-factor authentication , but the site apparently still sends those logging in an SMS code , which , in light of these recent SS7 attacks , totally undermines the extra security protections . Twitter did not immediately respond to a request for comment . Motherboard even recently published a piece telling general readers that they were likely fine with only SMS-based two-factor authentication , which focused on another type of attack and was based on the premise that non-state hackers were not widely using SS7 . That piece , clearly , is out of date . `` It is unacceptable the FCC and telecom industry have not acted sooner to protect our privacy and financial security , '' Lieu 's statement added .