Crooks exploit CVE-2018-7602 Drupal flaw, aka Drupalgeddon3 to deliver Monero miner

The flaw (CVE-2014-0160, widely known as 'Heartbleed') is an out-of-bounds read (CWE-125) in the TLS and DTLS implementations of OpenSSL, caused by improper handling of Heartbeat Extension packets. A remote, unauthenticated attacker triggers it by sending a crafted heartbeat request whose declared payload length exceeds the data actually sent, causing OpenSSL to copy up to roughly 64 KB of adjacent process memory into the response. The attacker gains chunks of process memory per request — potentially TLS private keys, session cookies, usernames and passwords — and can repeat the request to harvest more, typically without any trace in logs. Any server or client running a vulnerable OpenSSL release that enables TLS or DTLS heartbeats is affected, which at the time of disclosure included hundreds of thousands of internet-exposed HTTPS servers as well as appliances, load balancers, and bundled libraries. Exploitation is confirmed in the wild: the vulnerability is listed in CISA KEV (added 2022-05-04, required action: apply updates per vendor instructions) and EPSS assigns it the maximum 100% probability of exploitation within 30 days.

Do: Apply OpenSSL updates per your OS or vendor's instructions — the upstream fix at the time of the 2014 disclosure was OpenSSL 1.0.1g, with most distributions shipping backported patches — and restart or rebuild every service linked against OpenSSL, including bundled copies in load balancers, appliances, and VPN or management interfaces. Because leaked memory can include TLS private keys, treat keys and certificates on affected endpoints as compromised: rotate keys, reissue and revoke certificates, and invalidate session cookies and credentials that may have leaked. Confirm the heartbeat fix is present on all TLS/DTLS endpoints to satisfy the CISA KEV required action.

GNU Bash through version 4.3 improperly processes trailing strings that follow function definitions inside environment variable values, allowing injected commands to run (CWE-78, OS command injection); this flaw is widely known as 'Shellshock'. An attacker triggers it by supplying a crafted environment variable to any service that invokes Bash, most notably CGI web handlers but also SSH, DHCP clients, and other software that sets variables and spawns the shell. Successful exploitation yields arbitrary code execution with the privileges of the Bash process on the target host. Any Linux, Unix, or similar system running an unpatched Bash through 4.3 is affected, including web servers, appliances, and embedded devices that ship the shell. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-01-28) with a required action to apply vendor updates, and EPSS assigns it a 100% probability of exploitation within 30 days, so patching is urgent.

Do: Apply Bash updates per your OS vendor's instructions, as required by the CISA KEV listing, ensuring the installed shell is a patched build newer than the unpatched 4.3-era code. Prioritize internet-exposed systems that pass environment variables to Bash, especially CGI-based web servers, and audit embedded appliances and other Linux/Unix hosts that may have been missed by standard patching.

A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.

CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data.

Do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials.

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.