Microsoft today issued Vulnerability-related.PatchVulnerability an emergency security update to correct Vulnerability-related.PatchVulnerability a security update it issued Vulnerability-related.PatchVulnerability earlier this month to correct Vulnerability-related.PatchVulnerability a security update it issued Vulnerability-related.PatchVulnerability in January and February . In January and February , Redmond emitted Vulnerability-related.PatchVulnerability fixes for Windows 7 and Server 2008 R2 machines to counter Vulnerability-related.PatchVulnerability the Meltdown chip-level vulnerability in modern Intel x64 processors . Unfortunately , those patches blew Vulnerability-related.PatchVulnerability a gaping hole in the operating systems : normal applications and logged-in users could now access and modify any part of physical RAM , and gain complete control over a box , with the updates installed . Rather than stop programs and non-administrators from exploiting Meltdown to extract Attack.Databreach passwords and other secrets from protected kernel memory , the fixes on Windows 7 and Server 2008 R2 instead granted full read-write privileges to system RAM . Roll on March , and Microsoft pushed out Vulnerability-related.PatchVulnerability fixes on Patch Tuesday to correct Vulnerability-related.PatchVulnerability those January and February updates to close Vulnerability-related.PatchVulnerability the security vulnerability it accidentally opened . Except that March update did n't fully seal Vulnerability-related.PatchVulnerability the deal : the bug remained in Vulnerability-related.DiscoverVulnerability the kernel , and was exploitable by malicious software and users . Total Meltdown Now , if you 're using Windows 7 or Server 2008 R2 and have applied Vulnerability-related.PatchVulnerability Microsoft 's Meltdown patches , you 'll want to grab and install Vulnerability-related.PatchVulnerability today 's out-of-band update for CVE-2018-1038 . Swedish researcher Ulf Frisk discovered Vulnerability-related.DiscoverVulnerability the January and February Meltdown mitigations for Win7 and Server 2008 R2 were broken , and went public Vulnerability-related.DiscoverVulnerability with his findings once the March Patch Tuesday had kicked off . As it turns out , this month 's updates did not fully fix Vulnerability-related.PatchVulnerability things , and Microsoft has had to scramble to remedy Vulnerability-related.PatchVulnerability what was now a zero-day vulnerability in Windows 7 and Server 2008 . In other words , Microsoft has just had to put out Vulnerability-related.PatchVulnerability a patch for a patch for a patch . Hardly inspiring stuff , but we suppose the old Microsoft adage remains true – never trust a Redmond product until version three at the earliest . On the other hand , writing kernel-level memory management code is an absolute bastard at times , so you have to afford the devs some sympathy .

Adobe has emitted Vulnerability-related.PatchVulnerability software updates to address Vulnerability-related.PatchVulnerability a critical vulnerability in Flash Player for Windows , Mac , and Linux . PC owners and admins will want to upgrade Vulnerability-related.PatchVulnerability their copies of Flash to version 31.0.0.153 or later in order to get Vulnerability-related.PatchVulnerability the patch – or just dump the damn thing all together . The November 20 security update addresses Vulnerability-related.PatchVulnerability a single flaw , designated Vulnerability-related.DiscoverVulnerability CVE-2018-15981 . It is a type confusion bug that can be exploited Vulnerability-related.DiscoverVulnerability to achieve remote code execution . Basically , an attacker could slip the exploit code into a Flash .swf file , put it on a web page , and covertly install malware on any vulnerable machine that visits the page . Because Adobe does not maintain a fixed patching schedule Vulnerability-related.PatchVulnerability for Flash Player , this is n't technically considered an out-of-band band-aid . However , the update does come Vulnerability-related.PatchVulnerability just one week after Adobe pushed out Vulnerability-related.PatchVulnerability a handful of fixes for Patch Tuesday , including one for an information disclosure vulnerability in Flash Player . That Adobe would post Vulnerability-related.PatchVulnerability another update just one week after their last patch should underscore that CVE-2018-15981 is a serious enough vulnerability to be a priority fix Vulnerability-related.PatchVulnerability for users and admins . After installing Vulnerability-related.PatchVulnerability this latest fix , those who are tired of the constant security threats might also want to consider taking the advice of multiple security experts and developers and at least disable Flash by default if not permanently . The notoriously vulnerable plugin has long since been surpassed by HTML5 , and most major websites have already transitioned away from Flash , leaving it only really useful for specific sites and applications . Even Adobe wants to kill off Flash . The Photoshop giant has said that by 2020 it plans to formally retire the plugin once and for all .

Back in January 2013 , researchers from application security services firm DefenseCode unearthed Vulnerability-related.DiscoverVulnerability a remote root access vulnerability in the default installation of some Cisco Linksys ( now Belkin ) routers . The flaw was actually found Vulnerability-related.DiscoverVulnerability in Broadcom ’ s UPnP implementation used in popular routers , and ultimately the researchers extended Vulnerability-related.DiscoverVulnerability the list of vulnerable routers to encompass devices manufactured by the likes of ASUS , D-Link , Zyxel , US Robotics , TP-Link , Netgear , and others . “ Back in the days , Cisco fixed Vulnerability-related.PatchVulnerability the vulnerability , but we are not sure about all other router vendors and models because there are too many of them , ” the DefenseCode team noted . When DefenseCode first came out Vulnerability-related.DiscoverVulnerability with the vulnerability in 2013 , Rapid7 researchers also found Vulnerability-related.DiscoverVulnerability a number of flaws in other popular UPnP implementations , and by scanning the Internet , revealed Vulnerability-related.DiscoverVulnerability that there were approximately 15 million devices with a vulnerable Broadcom UPnP implementation . It ’ s difficult to tell how many of these devices are still vulnerable Vulnerability-related.DiscoverVulnerability but , as DefenseCode ’ s Leon Juranic pointed out to me , users rarely ( if ever ) update their router ’ s firmware , so there are bound to be still many of them . And given how many people have watched and analyzed their technical video of the exploit in action over the years , obviously many are interested in it . Still , I think we can all agree , four years is more than enough time for patching Vulnerability-related.PatchVulnerability , and nobody can fault them for publishing the exploit . Hopefully , if there are manufacturers that still haven ’ t pushed out Vulnerability-related.PatchVulnerability a patch they ’ ll do it now , but this is could also be a welcome impetus for users to update their router ’ s firmware – especially those that haven ’ t done it for years . Whitepapers and offers

Last week WordPress released Vulnerability-related.PatchVulnerability the newest version ( 4.7.2 ) of the popular CMS , ostensibly fixing Vulnerability-related.PatchVulnerability three security issues affecting versions 4.7.1 and earlier . What the WordPress team didn ’ t share at that time is that the update also secretly fixes Vulnerability-related.PatchVulnerability a bug that allows unauthenticated users to modify the content of any post or page within a WordPress site . The vulnerability was discovered Vulnerability-related.DiscoverVulnerability by Sucuri researcher Marc-Alexandre Montpas and responsibly disclosed Vulnerability-related.DiscoverVulnerability to the WordPress security team on January 20 . A fix was soon created Vulnerability-related.PatchVulnerability , tested , and included in the security update pushed out Vulnerability-related.PatchVulnerability on January 26 . The team reached out to makers of web application firewalls ( WAFs ) like SiteLock , Cloudflare , and Incapsula to help them create rules that would block exploitation attempts . WordPress hosts have also been privately told Vulnerability-related.DiscoverVulnerability of the flaw , and they quietly moved to protect their users . “ By Wednesday afternoon , most of the hosts we worked with had protections in place . Data from all four WAFs [ this includes Sucuri ’ s ] and WordPress hosts showed Vulnerability-related.DiscoverVulnerability no indication that the vulnerability had been exploited Vulnerability-related.DiscoverVulnerability in the wild , ” the WP security team disclosed Vulnerability-related.DiscoverVulnerability on Wednesday . “ As a result , we made the decision to delay disclosure of this particular issue to give time for automatic updates to run and ensure as many users as possible were protected before the issue was made public ” . Within a couple of hours of the release of the update Vulnerability-related.PatchVulnerability , WordPress users who have opted for the automatic WP update option had the WP 4.7.2 installed and were protected . The unauthenticated privilege escalation vulnerability in question affects Vulnerability-related.DiscoverVulnerability the REST API , which was added and enabled by default on WordPress 4.7.0