In brief: Two critical PHP flaws exploited days before patches; Arista Networks fixes actively exploited zero-day; and more.
It remains unclear how the attacker may have obtained information about the flaws before public disclosure.
The weakness could have allowed attackers to create trusted certificates for fake websites, impersonate legitimate sites, and intercept encrypted communications.
The attackers infected servers with Ebury Linux malware and changed the settings to intercept SSH connections.
The groups are using the flaw to gain initial access to corporate networks and bypass multi-factor authentication.
The attacks were focused on stealing sensitive information related to national security and defense.
According to Siemens, threat actors used a legitimate, digitally signed copy of the software and malicious DLL files to load the code.
