LiteSpeed Cache, an immensely popular WordPress plugin for site performance optimization, suffered from a vulnerability which allowed threat actors to gain admin status.
With such elevated privileges, they would be able to perform all sorts of malicious activities on the compromised websites.
According to researchers from Patchstack, the vulnerability was discovered in the is_role_simulation function, and it is relatively similar to a different vulnerability that was discovered last summer. The function apparently used a weak security hash check that could be broken with brute force, granting the attackers the ability to abuse the crawler feature and simulate a logged-in administrator.
Who is vulnerable?
There are a few factors that need to align before the vulnerability can be abused, though.
Advertisement
That includes having the crawler turned on, with run duration between 2500 and 4000, and the intervals between runs being set to 2500- 4000. Furthermore, Server Load Limit should be set to 9, Role Simulation to 1 (ID of user with admin role), and Turn every row to OFF except Administrator should be activated.
The vulnerability is now tracked as CVE-2024-50550, and has a severity score of 8.1 (high severity). It was already patched, with the version 6.5.2 of the plugin being the earliest clean one. LiteSpeed Cache is one of the most popular plugins of its kind, with more than six million active installations.
There is no talk of any evidence of in-the-wild abuse, so chances are cybercrooks have not picked up on the vulnerability in the past.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Advertisement
However, now that the patch is public, it’s only a matter of time before they start scanning for vulnerable websites. Currently, almost three-quarters (72.1%) of all LiteSpeed Cache websites are running the latest version, 6.5, with 6.7% running 6.4, and a notable 21.2% running “other” versions. Therefore, at least 27.6% of sites could be targeted, which is more than 1.6 million.
TIDAL, the high-definition music streaming platform, is not having the best of times. The company has already made layoffs, and its management has been mulling a potential restructuring to get back on track to profitability. Now, a report claims that an upcoming round of layoffs will affect around a quarter of the current TIDAL staff.
Competition in the music streaming service segment has become quite fierce. Other platforms have been getting more and more features and a growing catalog of songs. TIDAL’s main selling point over the others has always been Hi-Fi audio. While rival services were betting on formats with quality compression, TIDAL offered premium plans with lossless music.
TIDAL could get rid of a quarter of its staff in new round of layoffs
However, the arrival of high-quality audio plans at rival services probably led a percentage of TIDAL users to consider switching. While the latter’s Hi-Fi quality typically offers a higher bit rate than its rivals, only a specific niche of users truly value this feature. It even requires using earbuds or headphones of a certain range to enjoy it.
In December 2023, the company shed around 10% of its workforce. Now, according to Fortune, an upcoming round of layoffs will impact around a quarter of TIDAL’s workforce. The source says they gained access to a memo from Jack Dorsey, the CEO of Block Block Head (Tidal’s parent company). “We’re reducing the size of our design team and foundational roles supporting TIDAL, and we will consider reducing engineering over the next few weeks as we have more clarity around leadership going forward,” the memo said, according to Fortune.
Advertisement
In this round of layoffs, around 100 employees could leave the company. In July of this year, Dorsey was reportedly considering restructuring TIDAL. The staff reduction could align with this plan. TIDAL is not the only tech company to have made massive layoffs recently. Others, like DropBox and even Meta, have had to do the same.
Recent moves to make TIDAL more attractive
Earlier this year, in a move to become more competitive in the market, TIDAL bundled its Hi-Fi plans. Priced at $10.99, the new premium subscription undercuts the previous, more expensive one. The company has also made moves to solidify its position as a streaming service focused on Hi-Fi audio. The list includes setting FLAC as the default format and adding Dolby Atmos support.
The first American-made Polestar EVs are now on the road. The Swedish automaker said on Friday it delivered the first Polestar 3 SUVs to US and Canadian customers. The Inflation Reduction Act, signed by President Biden in 2022, incentivizes automakers to manufacture EVs in the US, offering tax credits for companies and buyers.
Polestar began stateside Polestar 3 production in August at its Ridgeville, South Carolina plant. Those vehicles will serve North American and European markets, complementing the company’s more established production in Chengdu, China.
The automaker says American and Canadian Polestar 3 deliveries will pick up steam in the coming weeks. You can take one for a spin if you live near one of the automaker’s Polestar Spaces, essentially brand-building fancy showrooms in or near major US cities.
The Polestar 3 is billed as the company’s coming-out party, expanding the niche reach of the first two models to a more mainstream audience. Engadget’s Tim Stevens tested the EV last month and found that, apart from a few early software glitches, the $73,400 and up SUV is “great.”
Around the corner is perhaps one of the most important elections this nation has ever seen, yet many people are still unaware of the details needed to cast informed ballots.
It’s not necessarily their fault — some voting information can be quite hard to find, especially when it comes to learning about, say, the political stances of judges up for recall or what a certain new amendment might mean for everyday life. In a very Silicon Valley way, there is an app looking to help with that called MyBallot AI, an interactive mobile platform to help make voting information more accessible.
All a user has to do is type into a chat box what they want to know about any upcoming elections and they will receive real-time answers to their questions.
The app, founded by Mark Larman, was publicly launched on Friday. It is powered by Google Gemini and sources its data from the Google Civic API and the BallotReady API. A little noteworthy feature is that the app reveals its sources when responding with information, perhaps as a way to avoid the plagiarism accusations that have plagued other chatbots.
Advertisement
On MyBallot, users can also fill out a sample ballot so they can start to familiarize themselves with the language on the ballot. Larman said he hired a developer back in February and “it just feels like a blessing to have it finally ready in time for the election.”
This app comes at a critical time. Misinformation remains a concern among voters this election and one person in particular is causing a stir for election officials: Elon Musk. CNN reports that states are trying to fact-check the billionaire to stop him from spreading claims that will “mislead voters.” Meanwhile, Axios reported that Facebook users are falling for AI images of fake people giving endorsements, with a flood of AI-generated content — including video and audio — taking hold over the internet. All of this, paired with the fact that search engines have deprioritized news, makes it hard for the average voter to find credible information about voting.
Larman says he’s wanted to build an app like this since the 2020 election. He spent time that year protesting the murder of George Floyd and, when he found himself in the voting booth, he recalled looking at the ballot and not recognizing who any of the judges were.
“I was out there protesting and then when it came time to vote I didn’t even know which of these judges was for us or against us,” he said.
He spent the next three years thinking about creating a product that could effectively educate voters. When access to artificial intelligence was democratized, he took that opportunity to start building MyBallot AI. Now, he’s in the process of fundraising and still works at his day job as he builds the app.
Advertisement
“The app is especially important now to exist as a verifiably non-biased source for information,” he continued, adding that voters feel like news right now is biased. “If people weren’t so uninformed and knew more about the issues and candidates they were voting for instead of just voting for the team, they’d feel less like they got cheated or lied to.”
Many young people are also taking to the polls for the first time. Efforts are made each election to engage young voters, who are less likely to vote than older people. Tufts estimates that in 2020, 50% of young people (considered between the ages of 18 to 29) voted in the presidential election, an increase from 39% in 2016.
Larman thinks young people are going to come out this election, pointing out that the youth are very active in politics, “but, on the other hand, they may be the least likely to take the effort to navigate the existing non-user friendly websites to learn about state and local elections and they certainly aren’t interested in reading any 100-page voting manuals sent to their house.”
MyBallot right now can be used anywhere in the U.S., though it says it has plans to expand to other countries soon.
Advertisement
Larman has other big plans for the app, too. He aims to build a networking component so that users will be able to directly ask questions to candidates running for office — he will start reaching out to representatives after the presidential election, just in time for the midterms. To boost engagement, Larman also hopes to add political quizzes that can then help give ballot recommendations and work with organizations and universities to reach even more voters.
“I want people to trust it as a tool that doesn’t necessarily care what you think, we just want you to think,” he said.
Epic Games is about to host big in-game event ahead of its next throwback season — and it could be pretty musical.
If you want to watch the event, here’s what you need to know.
The Remix: The Prelude event is set to kick off at 6:30PM ET / 3:30PM PT. Epic suggests logging in early so that you don’t miss the event; events have reached capacity in the past.
If you’re in the game, jump into a Battle Royale or Zero Build match ahead of the event’s start time and head to the Restored Reels location.
Advertisement
If you aren’t able to watch in-game, there will almost certainly be a bunch of streamers live-streaming the show, so check Twitch or YouTube to find one to watch.
Cybercriminals are attacking surveillance cameras from multiple manufacturers, leveraging two zero-day vulnerabilities to take over the endpoints, watch and manipulate the feeds, and more.
Cybersecurity researchers GreyNoise claim to have spotted the attacks after their AI-powered analysis tool Sift raised an alarm that crooks are attacking network device interface-enabled (NDI) pan-tilt-zoom (PTZ) cameras from multiple manufacturers.
The cameras can be found in different environments, including industrial and manufacturing plants, where they are used for machinery surveillance, and quality control. They can also be found in business conferences, used for high-definition video streaming and remote presentations, in healthcare (used for telehealth consultations and surgical live streams), state and local government environments, including courtrooms, and houses of worship, where they’re used for live streaming.
Waiting on patches
GreyNoise says the affected devices are typically high-cost, with some models costing several thousand dollars.
Advertisement
Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63.
The vulnerabilities in question are now tracked as CVE-2024-8956, and CVE-2024-8957. The former is deemed critical (9.1), and the latter high (7.2). When exploited, the vulnerabilities can be used to completely take over the cameras, view and manipulate video feeds, disable different camera operations, and assimilate the devies into a botnet.
While for some models, patches have already been released, others remain vulnerable. According to BleepingComputer, PTZOptics released a security update on September 17, but since multiple models reached end-of-life status (PT20X-NDI-G2 and PT12X-NDI-G2) not all were patched. Furthermore, PT20X-SE-NDI-G3, and PT30X-SE-NDI-G3 are still pending a fix.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Advertisement
Chances are, the list of affected models is a lot longer than what the researchers determined at this time. Users are advised to check with their manufacturer if they’ve released a fix for the abovementioned flaws.
You must be logged in to post a comment Login