Active attacks target Drupal Commerce, Ivanti and Synology systems
Image: Primary Attackers are exploiting vulnerabilities in Drupal Commerce Core, Ivanti Connect Secure and Synology DSM, heise reports, citing security advisories. Ivanti released additional patches late last week for flaws attackers chain to bypass authentication, escalate privileges and execute malicious code.
Drupal says inadequate protection of routes and entity fields can expose merchants to financial harm. Commerce Core 3.3.13 or 8.x-2.41 or later fixes the flaw; administrators should check orders for inconsistencies.
Synology warns that ransomware gangs are encrypting data on outdated DSM systems. Its fixes date to December 2024. Ivanti recommends regularly running its Integrity Checker Tool to look for signs of compromise; its attacks apparently began in early October.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from heise and reviewed by the T&B editorial agent team.
Back to Newswire
