「WordPressバックアッププラグインの欠陥により、数百万のサイトが乗っ取り攻撃の危険にさらされる 」： #BLEEPINGCOMPUTER

「WordPress用プラグイン「All-in-One WP Migration and Backup」に存在するSQLインジェクションの脆弱性により、認証されていない攻撃者がリモートでコードを実行し、影響を受けるウェブサイトを乗っ取ることができる可能性があります。

このプラグインは、データベース、メディア、テーマ、プラグインなどを含むウェブサイト全体を、サーバー間またはドメイン間でバックアップ、エクスポート、インポート、移動するために使用されます。

このセキュリティ上の脆弱性はCVE-2026-19949として追跡されており、深刻度スコアは高となっています。この脆弱性はセキュリティ研究者のジャック・テイラー氏によって発見され、8月中旬にDefiant社のサイバーセキュリティ部門であるWordfenceを通じて報告されました。 」

https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/

#prattohome

Critical WordPress vulnerability exposes 3.2 million sites to remote code execution via All-in-One WP Migration

https://thecybersecguru.com/news/cve-2026-19949-wp-migration-rce/

Nearly 22,000 internet-facing Exchange servers remain unpatched against CVE-2026-62911, an authentication bypass that can hijack every user's mailbox.

#CVE202662911 #MicrosoftExchange #AuthenticationBypass #Shadowserver #Patch

https://meterpreter.org/exchange-cve-2026-62911/?utm_source=mastodon&utm_medium=jetpack_social

Sangoma Switchvox Flaw Under Attack: 4,000 VoIP Systems Exposed https://www.esecurityplanet.com/threats/news-sangoma-switchvox-cve-2026-9586-rce/

RE: https://red.fox.yt/@coltofox/117171580672580504

This is finally resolved as of 2:20am last night after hours of migrating 18 domains, 34 mailboxes, 196 aliases, 1 distribution list, and 6 forwarders from Zimbra ZCS FOSS to mailcow. I'll note my technical journey down below if you're interested.

:blobfoxcomfycomputer:

This has been ongoing effort since the compromise last Friday with investigations into some solutions.

I thought about building Zimbra from source then stopped myself from the nightmare of management overhead of maintaining that.

So I looked at the directly compatible platform, Carbonio. I spun up a Rocky 10 VM to replace this (Rocky 9 is EOL next year so can't do that). I managed to get Carbonio EL9 installed on Rocky 10 but couldn't get the post-install script to run since it required Perl 5.32 when EL10 ships with Perl 5.40. I tried installing EL9 Perl but there were too many dependencies, then I tried Perlbrew but it would keep trying the system one regardless of the symlinks I'd try -- even tried using the system one but it didn't budge either.

So dependency hell kicked in and I thought, well maybe they have a docker container. So I installed docker on the Rocky 10 VM, got that all setup. But then I look at the Docker Hub page and while an image does exist, there is zero documentation anywhere and the last image was 8 months ago. So I lost confidence there.

Through the investigation on this journey of migrating away off of Zimbra Open Source I kept seeing references to mailcow. So I tried a demo of mailcow to grasp the platform. The demo didn't really convince me to like it, I still prefer the UI Zimbra had (especially the admin UI) but it seemed it could almost do everything I needed.

So I eventually got the mailcow docker containers up and running. The migration was a lot of busywork since I didn't really want to touch the old Zimbra Database.

I migrated every mailbox one-by-one, creating the accounts all from scratch then did the (imap)sync afterward. The aliases were a bit easier, I could grep a zmprov command on the old server to query a user then paste them into mailcow in bulk.

Then there was DNS... For the public BIND servers I could sed the MX and SRV records to the new hostname but I still had to enter and split up 18 DKIM records. Had to manually update some Cloudflare domains, then also all of the internal (split) DNS records too.

Then there was TLS... So I haven't completely finished this yet, but it's enough for mail transport. I can't use mailcow-acme because it doesn't support RFC 2136 so I had to look into manual certificates (still ACME, but OS level). Then I had to find out how I could handle 18 different domains in SNI instead of 1 giant certificate. Turned out this was possible, and I've configured the default domain (that the hostname uses). I still need to configure the other 17 domains but the groundwork is there for when I get around configuring all those autoconfig/autodiscover certs.

With that out of the way, the main migration completed. Some systems recognised the new server as the same one after I put in the CNAME from old to new. Some didn't and I'm gradually fixing those as I find them (stricter auth requirements, etc).

One thing I will say I like about mailcow is Exchange ActiveSync. Zimbra always kept that as a paid feature. This finally enables me to have push notifications and proper calendar sync. I noticed there was a note last year from the SOGO team that they planned to remove ActiveSync, I'm so glad they reversed that decision.

After almost a week with almost no email I see how important this server actually is. I installed Zimbra ZCS roughly 5 years ago to exit Google Workspace and I'm still glad I did.

Having control over the data directly is empowering to not have some big corporation feeding it into their AI models with a force opt-in approach (i.e. Google) or alternatives with questionable political views (i.e. Proton). Keep email decentralised!

Anyway, I'm happy I have email again now. Thanks for reading! :blobfoxheart:

#Zimbra #mailcow #email #server #selfhosting #cve202673570

spent a bit'o time dealing with CVE-2026-73570 couple of days ago

about 6 hours

scraped thru as much as I could, found no real concerns aside from bad actors hitting my hosts so hard, they filled my available storage & crashed'em

(i log stuff, esp dns, excessively)

added bunch of /8s, /12s, etc to my drop firewall rules, blah blah

spent time disabling snmp (nothing 's' about it) on my zimbra instance, so it starts clean

all good
so far

funny
about same timeframe as outlook debacle

huh

⚠️ CRITICAL: Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco released patches for CVE-2026-20212, a critical unauthenticated remote code execution vulnerability in Nexus 9000 switches (10 Silicon One-based models). Attackers can exploit this via TCP ports 43210 and 43211 to execute commands as root. If you run affected Nexus 9000 hardware, this is imme…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-85012 - Command Injection in AWS codecatalyst-blueprints. Arbitrary command execution via crafted .ownership-file. CVSS 8.0. Update to v0.3.156 now. #CVE #AWS #infosec

https://www.valtersit.com/cve/CVE-2026-85012/

CVE-2026-59346, a critical VMware Workstation vulnerability, lets an attacker escape a guest VM and execute code on the host. Broadcom rates it 9.3 CVSS.

#VMware #Workstation #Fusion #CVE202659346 #VMXNET3 #Broadcom #InfoSec #PatchNow

https://securityonline.info/vmware-cve-2026-59346-code-execution-host/?utm_source=mastodon&utm_medium=jetpack_social

A public announcement exists for the Cisco Secure Email vulnerability pair in S/MIME decryption, plus a Cisco phone SIP denial-of-service flaw.

#Cisco #SecureEmail #SMIME #CVE202620354 #CiscoPhone #DoS #InfoSec #NetworkSecurity

https://securityonline.info/cisco-secure-email-smime-phone-dos-disclosed/?utm_source=mastodon&utm_medium=jetpack_social