Welcome to Gone Phishing, your daily cybersecurity newsletter that’s like your own personal Trojan against, well, trojans 👀🍆💀

It’s Friday, folks, which can only mean one thing… It’s time for our weekly segment!

It goes by many names. Patch of the Week, Tweak of the week. Okay, that’s it.

Congrats, the cybercriminals are no match… for your patch! 🩹🩹🩹

Stop the WordPresses! 📰🛑💡

🚨 URGENT SECURITY UPDATE! 💾

🔒 Good news, WordPress users! The threat posed by the critical security flaw in the WP-Automatic plugin has been SOLVED! 🛡️ Thanks to a new patch, your sites will once again be safe (so long as you update to version 3.9.2.0 or later!)

🔍 The Issue: Threat actors were actively exploiting a critical security flaw in the WP-Automatic plugin for WordPress. This flaw, tracked as CVE-2024-27956, had a CVSS score of 9.9 out of 10, making it extremely dangerous. 😱 It affected all versions of the plugin before 3.9.2.0.

🛠️ The Fix: This vulnerability, identified as a SQL injection (SQLi) flaw, allowed attackers to gain unauthorised access to websites. They could create admin-level user accounts, upload malicious files, and potentially take full control of affected sites. But fear not! The brilliant minds behind WPScan have provided a solution. 💡 They've patched the flaw, sealing off this vulnerability for good!

📢 What You Need to Know: The flaw was rooted in the plugin's user authentication mechanism. Attackers could exploit it by sending specially crafted requests to execute arbitrary SQL queries against the database. 😱 But with the latest patch, this loophole has been closed, ensuring your WordPress sites remain secure. Phew! 😅

👏 Thank You: A big shoutout to the Automattic-owned company for swiftly addressing this issue. Your dedication to WordPress security is truly commendable! 🙌

🔐 Stay Safe: Remember, keeping your plugins and WordPress installations updated is crucial for maintaining a secure online presence. Stay vigilant and keep those updates rolling in! 💪

Now, on to today’s hottest cybersecurity news stories:

• 👨‍💻 State-sponsored hackers target 2 Cisco zero-days for espionage 🕵️

• ☠️ Beware! New SEO-poisoning campaign is sneakier than ever 👥

• 🚪 Ring customers given $5.6 million in privacy breach settlement 💰

Where’s the Cisco Kid when you need him? 🤠🏜️🌵

makeagif.com

🚨 New Malware Campaign Targets Cisco Gear with Zero-Day Flaws! 🎯

🔒 Cisco gear faces a new threat as a sophisticated state-sponsored actor, UAT4356 (also known as Storm-1849), launches a sneaky malware campaign dubbed ArcaneDoor. 😱

🛡️ The Threat: UAT4356 exploited two zero-day flaws in Cisco networking gear to deploy custom malware, including backdoors named 'Line Runner' and 'Line Dancer.' These backdoors enabled malicious actions like reconnaissance, network traffic capture, and even potential lateral movement within target environments.

🛠️ The Flaws: The vulnerabilities, CVE-2024-20353 and CVE-2024-20359, allowed attackers to execute malicious code and disrupt web services on Cisco Adaptive Security Appliances and Firepower Threat Defense Software. 😨

🛡️ CISA's Response: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged these vulnerabilities, urging federal agencies to apply fixes provided by Cisco before May 1, 2024.

🕵️ The Tactics: UAT4356's meticulous tactics include deploying implants to hide digital footprints and evade detection. These implants, Line Dancer and Line Runner, give attackers persistent access to compromised devices, even surviving reboots and upgrades. 🕵️‍♂️

🔍 What's Next: While the exact origin of ArcaneDoor remains unclear, the attacks underscore the importance of patching and monitoring perimeter network devices. With edge devices increasingly targeted, vigilance is key to thwarting cyber threats. 💪

Stay informed, stay secure! Keep an eye out for updates on this evolving situation. 🔒

SEOh-no! The black hats are back! 👀🎩😈

🚨 Alert: Malware Menace Unveiled! 🎭

🔍 Unmasking the Threat: Zscaler ThreatLabz's latest investigation reveals a disturbing trend: the proliferation of fraudulent websites across popular hosting platforms. 😱

These sites, fueled by cybercriminals' cunning, exploit user behaviour using sophisticated Black Hat SEO tactics, notably SEO poisoning. Their aim? To spread malware far and wide, posing a significant threat to unsuspecting users.

🎯 The Cyber Threat Explained: These deceptive websites cloak themselves in the guise of legitimacy, leveraging SEO manipulation to dominate search engine rankings.

Once users fall into the trap and engage with these seemingly innocuous sites, malware swiftly infiltrates their systems. This sets the stage for potential financial extortion and other malicious activities, leaving victims vulnerable to cyber exploitation.

💡 Protective Measures: Safeguard yourself by exercising caution when downloading software. Avoid sources of dubious repute and prioritise reputable websites and trusted software providers.

💪 By fortifying your digital defences and staying vigilant against cyber threats, you can navigate the online landscape with confidence and security. 🔒

🎣 Catch of the Day!! 🌊🐟🦞

My Favorite Newsletter: Stay ahead on the business of AI 

Have you heard of Prompts Daily newsletter? I recently came across it and absolutely love it.

AI news, insights, tools and workflows. If you want to keep up with the business of AI, you need to be subscribed to the newsletter (it’s free).

Read by executives from industry-leading companies like Google, Hubspot, Meta, and more.

Want to receive daily intel on the latest in business/AI?

In just ONE click, you can quickly sign up to the free Prompts Daily newsletter.

Geez, Ring up the cash register 💸💸💸

🚨 Ring Users Alert: Refunds Incoming! 💰

The Federal Trade Commission (FTC) is taking action! They're sending out a whopping $5.6 million in refunds to Ring users who've had their private video feeds accessed without consent by Amazon employees and contractors, or suffered hacks due to inadequate security measures. 😱

🔐 The Settlement: This initiative stems from a complaint lodged in May 2023, accusing Ring of failing to implement sufficient security protocols to safeguard devices from unauthorised access. Now, as part of the settlement, over 117,000 Ring consumers will receive payments through PayPal.

🏡 About Ring: Ring, an Amazon subsidiary, offers a range of smart home security products, from video doorbells to motion-activated lights. These devices provide remote access and control via a mobile app, but lax security measures left users vulnerable to breaches.

🛡️ Security Concerns: The FTC alleged that Ring granted its employees and third-party contractors unrestricted access to user devices, compromising privacy and security. Additionally, the lack of multi-factor authentication until 2019 made it easier for hackers to hijack accounts and access private video feeds.

💸 Getting Your Refund: If you're one of the eligible Ring customers, keep an eye on your PayPal account! You have 30 days to redeem your refund. For more details on the refund process, check out the FTC's FAQ page.

Stay informed, stay secure! Your privacy matters. 🔒

🗞️ Extra, Extra! Read all about it! 🗞️

Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!

• 🛡️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday 📅

• 💵 Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for 🆓

• 📈 Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future 👾

Let us know what you think.

So long and thanks for reading all the phish!