Supply-chain watch

YOOtheme Pro, a popular theme and page builder used to design Joomla and WordPress websites, had a serious flaw in how it resizes images. An attacker with no login could abuse it to plant their own code on the website and take it over. YOOtheme fixed it in version 5.0.53 on 21 October. The official record's score marks it as attacked, but no details of real-world attacks have been published, so active exploitation is not confirmed.

TeamUpdraft, the company behind the popular UpdraftPlus backup plugin for WordPress websites, confirmed that attackers broke into its website and likely took its customer database, including the keys its UpdraftCentral service uses to remotely manage customers' sites. The company says attackers then used those keys to add hidden admin accounts and malicious plugins to some connected WordPress sites. How many sites were hit is not known.

Signal, the private messaging app, had a flaw in the part that handles voice and video calls. A caller could flood the call with data so that pressing hang-up did not actually end it, possibly keeping your microphone or camera connected. It is fixed in newer versions of Signal's calling library; active exploitation is not confirmed.

Laravel, a popular toolkit for building PHP websites and web apps, has a serious login flaw. In apps that use its built-in token login for APIs (the way other programs connect to a web app) with a MySQL or MariaDB database, an attacker could log in as another user without their key. Fixes are out; active exploitation is not confirmed.

Node.js, the software that runs JavaScript on millions of web servers and developer tools, has released security updates fixing 10 problems. The worst lets an attacker who sends specially compressed data run their own code on the server, and two others can let a fake website certificate be accepted. Updates are out; active exploitation is not confirmed.

OVHcloud, a French cloud provider, says an attacker used a staff developer's hijacked GitHub account to swap the downloads of its command-line tool (a program admins use to manage their cloud services) for malware that hunts for passwords and keys. The bad files were up for about an hour and a half on 19 October and were downloaded about 250 times. OVHcloud has confirmed it and removed them.

Oracle has put out an emergency fix for Java, the software platform that runs many business and web applications. The flaw is in the part of Java that handles secure (encrypted) connections, and Oracle says attackers could use it over a network without needing a password. Oracle's alert does not say it is being exploited; active exploitation is not confirmed.

Pillow, a widely used Python library that programs use to open and edit pictures, has a serious flaw. A specially crafted image file in certain formats can crash a program that opens it and, in some setups, let an attacker run commands. A fix is out in version 13.0.0; active exploitation is not confirmed.

Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.

LiteLLM is a popular open-source tool that developers use to connect their apps to AI models. On 21 October attackers hijacked its release process and published a fake version, 1.107.0, containing malware that steals passwords and access keys from any machine that installs it. LiteLLM has confirmed the incident and removed the bad version.

PHP, the programming language behind a large share of websites, released updates on 21 October that fix two serious flaws that can let someone with no login take control of a web server. Amazon's security team says attackers are now broadly trying these flaws against real internet-facing systems, with a first attempt seen on 17 October, four days before the fix came out. Active exploitation is confirmed by Amazon's own monitoring.