Apache Servers Exposed 🌐 + 61K GitHub Repos Hit by Secret Thieves 🕵️

Today's two biggest security stories hit the backbone of the internet: the software that serves millions of websites, and the code platform where much of the world's software gets built. If you run a website or write code, both deserve five minutes of your attention.

🌐 A Critical Hole in Apache Could Hand Your Web Server to Strangers

Apache HTTP Server is one of the most widely used pieces of software on the internet, quietly powering a huge share of the world's websites. Researchers found a serious memory flaw (rated 9.8 out of 10 for severity) in the part of Apache that handles modern HTTP/2 connections, affecting versions 2.4.55 through 2.4.70. In plain terms, an attacker doesn't need a password or an account to exploit it, they just send the right kind of traffic and can take over the server. Experts disagree on how easy it is to pull off right now, but nobody wants to find out the hard way. If your business runs a website, ask your IT team or hosting provider today whether they've upgraded to Apache 2.4.71 (or turned off HTTP/2 until they can).

Read more →

🕵️ Hackers Hijacked 4,800 GitHub Accounts to Pick the Pockets of 61,000 Projects

A campaign nicknamed "WFX-Loot" used stolen GitHub logins from 4,837 developers to quietly submit 61,764 fake code changes to other projects. At least 1,835 of those projects automatically ran the malicious code, which then stole the "keys to the kingdom": passwords, cloud access, and even AI service tokens stored in their build systems. Worse, the malware can plant hidden backdoors in Amazon and Microsoft cloud accounts that keep working even after the stolen keys are changed. The takeaway for everyone: the tools that build and ship software are now a prime target, so companies should review what their automated build systems are allowed to run and touch, and audit their cloud accounts for access they didn't set up.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.