Loki Intelligence — Security Briefs · Published
Daily Security Brief: SiteGuard WAF Exploitation, ConnectWise Identities, Drupal RCE
Today's reports show exposed edge and platform components under pressure: a security appliance is being exploited, a vendor's application identities were abused against customer tenants, and a widely used CMS needs urgent patching. Teams should prioritize patching internet-facing systems, reviewing third-party application access in Microsoft 365, and updating Drupal before exploits appear.
Signal 01 · BleepingComputer
Hackers exploit SiteGuard WAF flaw to run commands as admins
BleepingComputer reports that attackers are actively targeting an OS command injection vulnerability in SiteGuard Server Edition. Successful abuse reportedly lets them run commands with root or SYSTEM privileges on affected servers.
Why it matters: A security control that sits in front of applications becomes a high-value target when it is vulnerable, so confirm whether you run it, apply vendor fixes promptly, and restrict and monitor its management exposure.
Source: BleepingComputer
Signal 02 · The Hacker News
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise said it disabled seven of its application identities while investigating an incident in which unknown actors gained unauthorized access to those identities and compromised Microsoft 365 tenants. The report also notes the company suspended its cloud backup service.
Why it matters: Audit which third-party applications hold consent or service permissions in your Microsoft 365 tenant, remove ones you do not need, and watch sign-in and audit logs for unexpected activity from them.
Source: The Hacker News
Signal 03 · BleepingComputer
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal released fixes for two critical vulnerabilities that could allow remote code execution on sites running any supported version of the CMS. The project warns that exploits may emerge soon.
Why it matters: Schedule the Drupal update as an urgent change, inventory all instances including staging and forgotten sites, and add monitoring while patches roll out.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.