A quiet week in infosec <.<

What happened?

Welcome to this week’s edition of the Threat Source newsletter. “The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to work and woefully at sea.” — Lauren Groff I doubt Lauren had this maniacal infosec news cycle in mind when she wrote about the terrifyingly unpredictable future, but honestly, she’s got our current careers down cold. Let he who is not woefully at sea cast the first water balloon? I’ll work on it.

Key details

• CISA added two critical PHP remote code execution vulnerabilities to the Known Exploited Vulnerabilities catalog on Monday.
• An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell, and Python packages and can lead to code execution.
• GMO Internet reports suspected unauthorized access to its Onamae cloud desktop service, with hackers posting stolen customer data.
• Interpol's Operation Serengeti third sweep resulted in 1,462 arrests across 20 African countries and the U.S., recovering $105 million in stolen funds.
• Talos reported eight compromised intermediate certificates belonging to eMudhra's intermediate certificate authority.

Summarised by SecOraLens from Cisco Talos. Always read the original source before acting. How SecOraLens verifies advisories.