Remember when the sky -- or at least Ryzen -- was falling ? You should , because it was only a few months ago , when the CTS Labs security company revealed Vulnerability-related.DiscoverVulnerability numerous vulnerabilities in AMD 's new Ryzen and EPYC processor lines . AMD has been largely quiet about these vulnerabilities in the time since , but the company assured Tom 's Hardware that it has n't forgotten about CTS Labs ' report or neglected to address Vulnerability-related.PatchVulnerability the flaws in its processors . A quick recap : In March , CTS Labs released information Vulnerability-related.DiscoverVulnerability on a collection of vulnerabilities in AMD 's latest chips that it dubbed `` Ryzenfall . '' These security flaws were said to be present in Vulnerability-related.DiscoverVulnerability the most basic aspects of the Ryzen and EPYC processors , and after consulting with other researchers , CTS Labs decided to publish Vulnerability-related.DiscoverVulnerability its findings without giving AMD the customary 90-day notice between a vulnerability's discovery Vulnerability-related.DiscoverVulnerability and its public disclosure Vulnerability-related.DiscoverVulnerability . Earlier this week , CTS Labs emailed us to express concern about the lack of updates Vulnerability-related.PatchVulnerability from AMD regarding these vulnerabilities . The company said it believed many of the vulnerabilities would take months to fix Vulnerability-related.PatchVulnerability , with the Chimera issues requiring a hardware change that could n't be implemented in products that have already shipped . AMD 's relative silence and lack of updates Vulnerability-related.PatchVulnerability apparently led CTS Labs to believe the company had stalled out . We reached out to AMD for comment and received the following in response : Within approximately 30 days of being notified Vulnerability-related.DiscoverVulnerability by CTS Labs , AMD released Vulnerability-related.PatchVulnerability patches to our ecosystem partners mitigating Vulnerability-related.PatchVulnerability all of the CTS identified vulnerabilities on our EPYC™ platform as well as patches mitigating Vulnerability-related.PatchVulnerability Chimera across all AMD platforms . These patches are in final testing with our ecosystem partners in advance of being released publicly Vulnerability-related.PatchVulnerability . We remain on track to begin releasing Vulnerability-related.PatchVulnerability patches to our ecosystem partners for the other products identified in the report this month . We expect these patches to be released publicly Vulnerability-related.PatchVulnerability as our ecosystem partners complete their validation work . That 's still vague -- we do n't know to what `` ecosystem partners '' these patches have been delivered Vulnerability-related.PatchVulnerability nor when they should be expected to roll out -- but it does show that AMD has n't simply forgotten about CTS Labs ' report . We expect to hear more about these patches and how AMD plans to address Vulnerability-related.PatchVulnerability them as the company and its partners get them ready to ship . In the meantime , it seems that much like the sky , Ryzen has yet to fall .

Independent security researcher Dawid Golunski has released Vulnerability-related.DiscoverVulnerability a proof-of-concept exploit code for an unauthenticated remote code execution vulnerability in WordPress 4.6 ( CVE-2016-10033 ) , and information about an unauthorized password reset zero-day vulnerability ( CVE-2017-8295 ) in the latest version of the popular CMS . The vulnerability exists in Vulnerability-related.DiscoverVulnerability the PHPMailer library , and can be exploited Vulnerability-related.DiscoverVulnerability by unauthenticated remote attackers to gain access to and compromise an target application server on which a vulnerable WordPress Core version is installed ( in its default configuration ) . “ No plugins or non-standard settings are required to exploit the vulnerability , ” Golunski noted . The hole has been responsibly disclosed Vulnerability-related.DiscoverVulnerability to the WordPress Foundation , and has been plugged Vulnerability-related.PatchVulnerability in January , with the release of WordPress 4.7.1 . Still , according to the Foundation ’ s own numbers , nearly 11 percent of all WordPress installation out there are still stuck on the vulnerable version 4.6 . And , as Golunski noted Vulnerability-related.DiscoverVulnerability , it ’ s possible that older WordPress versions are also affected Vulnerability-related.DiscoverVulnerability by the same flaw , so the percentage of vulnerable installations could be considerably higher : Admins who still run these older versions of the popular CMS should upgrade Vulnerability-related.PatchVulnerability to newer versions , ideally to the latest one ( v4.7.4 ) . Still , even that might not be a guarantee against compromise , as Golunski has also publicly released Vulnerability-related.DiscoverVulnerability information and POC code for an unauthorized password reset vulnerability ( CVE-2017-8295 ) that the WordPress Foundation is yet to patch Vulnerability-related.PatchVulnerability . According to him and BeyondSecurity , whose SecuriTeam coordinated the disclosure Vulnerability-related.DiscoverVulnerability of the flaw to the WordPress developers , the discovery Vulnerability-related.DiscoverVulnerability of the vulnerability dates back to mid-2016 . Golunski found Vulnerability-related.DiscoverVulnerability it in version 4.3.1 of the CMS . “ WordPress has a password reset feature that contains Vulnerability-related.DiscoverVulnerability a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication . Such attack could lead to an attacker gaining unauthorized access to a victim ’ s WordPress account , ” BeyondSecurity explained . “ The vulnerability stems from WordPress using untrusted data by default when creating a password reset e-mail that is supposed to be delivered only to the e-mail associated with the owner ’ s account. ” Golunski says Vulnerability-related.DiscoverVulnerability that the issue was reported Vulnerability-related.DiscoverVulnerability to the WordPress security team multiple times , but they did not confirm whether it has been patched Vulnerability-related.PatchVulnerability . He ultimately decided to publish Vulnerability-related.DiscoverVulnerability his findings , and offer Vulnerability-related.PatchVulnerability a temporary solution ( “ users can enable UseCanonicalName to enforce static SERVER_NAME value ” ) .

The hacker leaked Attack.Databreach the FBI.GOV accounts that he found in several backup files ( acc_102016.bck , acc_112016.bck , old_acc16.bck , etc ) . Leaked records contain accounts data , including names , SHA1 Encrypted Passwords , SHA1 salts , and emails . The intrusion occurred on December 22 , 2016 , the hacker revealed Vulnerability-related.DiscoverVulnerability to have exploited Vulnerability-related.DiscoverVulnerability a zero-day vulnerability in the Plone Content Management System Going back to 22nd December 2016 , I tweeted about Vulnerability-related.DiscoverVulnerability a 0day vulnerability in Plone CMS which is considered as the most secure CMS till date . The vulnerability resides in Vulnerability-related.DiscoverVulnerability some python modules of the CMS . The hacker noticed that while media from Germany and Russia published the news about the hack , but US based publishers ignored it . According to CyberZeist , the FBI contacted him to pass on the leaks . `` I was contacted by various sources to pass on the leaks to them that I obtained after hacking FBI.GOV but I denied all of them . just because I was waiting for FBI to react on time . They didn ’ t directly react and I don ’ t know yet what are they up to , but at the time I was extracting my finds after hacking FBI.GOV , '' he wrote . The expert added further info on the attack , while experts at the FBI were working to fix Vulnerability-related.PatchVulnerability the issue , he noticed Vulnerability-related.DiscoverVulnerability that the Plone 0day exploit was still working against the CMS backend . ) , but I was able to recon that they were running Vulnerability-related.PatchVulnerability FreeBSD ver 6.2-RELEASE that dates back to 2007 with their own custom configurations . Their last reboot time was 15th December 2016 at 6:32 PM in the evening . `` While exploiting FBI.GOV , it was clearly evident that their webmaster had a very lazy attitude as he/she had kept the backup files ( .bck extension ) on that same folder where the site root was placed ( Thank you Webmaster ! ) , but still I didn ’ t leak out Attack.Databreach the whole contents of the backup files , instead I tweeted out Vulnerability-related.DiscoverVulnerability my findings and thought to wait for FBI ’ s response '' Now let ’ s sit and wait for the FBI ’ s response . I obviously can not publish Vulnerability-related.DiscoverVulnerability the 0day attack vector myself . The hacker confirmed Vulnerability-related.DiscoverVulnerability that the 0-day is offered for sale on Tor by a hacker that goes by the moniker “ lo4fer ” . Once this 0day is no longer being sold , I will tweet out Vulnerability-related.DiscoverVulnerability the Plone CMS 0day attack vector myself . Let ’ s close with a curiosity … CyberZeist is asking you to chose the next target . The hacker is very popular , among his victims , there are Barclays , Tesco Bank and the MI5 .