Today was an eventful day thanks to many interesting blog posts, e.g. from my friends at watchTowr. So I thought, why not publish a small quick-and-dirty blog post myself about a story from last week? This blog post may not be of the usual quality, but it was a good time to write it.

• A vulnerability in DigiEver DS-2105 Pro DVRs is being exploited to spread malware.

• The Akamai Security Intelligence Research Team (SIRT) noticed this activity in their honeypots on November 18, 2024.

• The vulnerability was originally discovered by Ta-Lun Yen and a CVE identifier has been requested by the Akamai SIRT.

• The malware is a Mirai variant that has been modified to use improved encryption algorithms.

• We have included a list of indicators of compromise (IoCs) in this blog post to assist in defense against this threat.

Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Advanced Custom Fields PRO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.1.6.