OpenX Promises Fix for Rogue Ads Bug
Summary: Attackers are exploiting a cross-site request forgery flaw in OpenX 2.8.8, the latest version of the ad-serving software, to add rogue administrator accounts named "openx-manager" and load tainted ads that push malware and browser exploits onto sites using the platform. Researcher Mark Baldwin traced the account creation to JavaScript loaded through an iframe on the OpenX dashboard, and OpenX CTO Michael Todd said the company would publish mitigation guidance and release a new version of OpenX Source on Monday or Tuesday.
What you should know: The malicious account was created the instant an administrator logged in, with no interaction from the victim, so the act of signing in to manage your own ad server is what hands over control. OpenX's communications head cut the interview short after two questions, leaving unanswered whether OpenX's own systems were abused and how long the company knew.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026