Daily Briefing

CISA flags four actively exploited flaws — in Check Point, Arista, and F5 gear — as WordPress and Chrome ship urgent fixes

By The IT Security Desk

Good morning. CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Per CISA, the four affect Check Point (an improper certificate validation flaw and a path traversal flaw across multiple products), Arista VeloCloud Orchestrator (improper input validation), and F5 BIG-IP APM. If you run any of these, prioritise them.

The Check Point entries connect to a separate disclosure. The Hacker News reported that Check Point warned attackers exploited a previously unknown flaw in its Security Management Server in a handful of targeted attacks on July 23. The Hacker News says the flaw lets an attacker who can access the server's web service run scripts on it without logging in, and that Check Point released a fix on September 2.

WordPress patched a critical core flaw. The Hacker News reported that the flaw lets an attacker with no account make a site load a PHP file from outside its theme folders, and on some servers run their own code; the fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch.

Read the full briefing →