Cybersecurity

On October 1, 2022, Microsoft began the scheduled retirement of Basic Authentication for several Exchange Online connection methods. The change affected older email clients and applications that depended on those methods. Microsoft’s lifecycle announcement identifies the start of the rollout; it was not a single simultaneous cutoff for every organization and every email protocol. Why the authentication method matters Basic Authentication relies on a username and password...

A contact form should help a prospective customer explain a need and reach the right person. Automated submissions can turn that useful channel into a sorting job, while an awkward verification step adds effort for legitimate visitors. On September 28, 2022, Cloudflare introduced the open beta of Turnstile, a CAPTCHA alternative designed to reduce that friction. It could be integrated without routing a website’s traffic through Cloudflare, making it an option to assess...

The Log4Shell disclosures in December 2021 drew attention to a critical vulnerability in Apache Log4j, a logging library used by Java applications. Identified as CVE-2021-44228, it could allow remote code execution in affected software. National cybersecurity authorities issued alerts as organizations worked to identify vulnerable products. Find the component, not just the website language Log4j is a Java library. Log4Shell was not a vulnerability in PHP itself, and the...

In March 2019, Wordfence described exploitation of a vulnerability in Abandoned Cart Lite for WooCommerce. Malicious data stored by the plugin could run code in the browser when an administrator reviewed abandoned carts. The observed attacks sought administrator access and installed ways to retain access. WordPress and its plugins need separate maintenance This case showed why an updated WordPress installation can still contain a vulnerable plugin. Maintenance needs to...

Major WordPress releases can prompt legitimate questions about compatibility and maintenance. They can also provide a pretext for unsolicited offers that pressure a site owner into paying an unfamiliar company. Nuagerie’s warning during the preparation of WordPress 5.0 concerned this second situation. Verify the request before granting access A message claiming that your site will disappear or stop working unless you immediately purchase a service deserves careful...

Fraudulent messages can impersonate cPanel, a hosting provider or an email service to obtain account credentials. A campaign reported in 2018 used fake confirmation and update requests. The underlying technique is familiar: persuade the recipient to sign in on a page that resembles the service they normally use. Check the request before signing in A logo, polished layout or sender display name does not authenticate an email. Mistakes can raise suspicion, but their absence...

In July 2018, Nuagerie updated its servers to Imunify360 3.4.1. The release combined maintenance fixes with the production release of Proactive Defense, a feature intended to identify potentially malicious behavior during PHP script execution. Protection during application execution The feature’s behaviour depends on its configuration. Availability does not mean that the same blocking mode is applied to every account. Proactive Defense added a different perspective to...