Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys describes Log4Shell as an easy-to-exploit vulnerability discovered in mid-December 2021 that can affect any Java application using a vulnerable version of Log4j, and notes that most enterprises were still determining whether and how widely they were...
Qualys published guidance and an open source utility for remediating Log4Shell (CVE-2021-44228) by removing the JndiLookup class from vulnerable Log4j libraries, an approach it says is becoming a popular immediate remediation option. The utility relies on...
Qualys Threat Research identified a Lazarus campaign using employment phishing documents named "Lockheed_Martin_JobOpportunities.docx" and "Salary_Lockheed_Martin_job_opportunities_confidential.doc", both authored by a user named "Mickey", targeting job...
Microsoft's February 2022 Patch Tuesday release addresses 70 vulnerabilities, none rated critical, though several carry High ratings in the CVSSv3.1 range of 7.0 to 8.9, and none are known to be exploited in the wild as of the writing. The fixes cover RCE...
The Qualys Research Team discovered multiple vulnerabilities in snap-confine, the program snapd uses to build the execution environment for sandboxed snap applications on Linux, the most important tracked as CVE-2021-44731. Qualys researchers verified the...
CISA released Binding Operational Directive 22-01 in November 2021, requiring federal agencies to remediate vulnerabilities in its Known Exploited Vulnerabilities catalog on set timelines, and CISA has released 654 CVEs in total, with its most recent...
HermeticWiper, a data wiper deployed beginning February 23, 2022, targeted hundreds of Ukrainian government websites and destroys a system's master boot record to render it unusable. The malware was signed with a code-signing certificate issued to...
AvosLocker, a ransomware-as-a-service operation first spotted in late June 2021, has added a Linux variant that targets VMware ESXi virtual machines and can kill running ESXi VMs. The Windows version appends ".avos" or ".avos2" extensions and uses RSA plus...
Qualys analyzed anonymized security data from its Cloud Platform across global enterprise networks to assess how organizations implemented the Log4j2 library after Log4Shell was disclosed on December 9, 2021. Nearly 1 million attack attempts were launched...
Qualys researchers tested WSL abuse on two Windows 10 virtual machines (version 20H2, build 19042), one running WSL1 and one WSL2, using PowerShell script block logs, command line process auditing, and Sysmon. They found that enabling WSL requires elevated...
MITRE Engenuity's round 4 ATT&CK Evaluations tested vendors against attacks modeled on the Wizard Spider and Sandworm APT groups, and Qualys Multi-Vector EDR detected 100% of the tested steps with 74% visibility into the attack chain. Qualys ran the...
Qualys released Qualys VMDR for ITSM, a certified app on the ServiceNow NOW Platform that imports Qualys vulnerability findings (QIDs) into ServiceNow ITSM on-demand or on a schedule, creates and assigns tickets, and closes them automatically once Qualys...
On June 02, 2022, Atlassian published an advisory for CVE-2022-26134, an unauthenticated OGNL injection remote code execution vulnerability in Confluence Server and Data Center affecting versions after 1.3.0, rated 9.8 on CVSSv3 and reported as actively...
Microsoft fixed 84 vulnerabilities in its July 2022 Patch Tuesday update, four of them critical and allowing remote code execution, and the cumulative Windows update includes the fix for one actively exploited zero-day, CVE-2022-22047, a Windows CSRSS...
Qualys researchers detailed BPFDoor, a Linux/Unix backdoor that uses Berkeley Packet Filters to attach a network filter to a socket and supports TCP, UDP, and ICMP for command-and-control, attributed to a Chinese threat actor group called Red Menshen (aka...
Qualys published Part 4 of its API Best Practices series, releasing QualysETL, an open-source Python blueprint under the Apache 2 License that extracts Qualys CSAM asset data into compressed JSON or a timestamped SQLite database. The post walks through...
Qualys describes a 2026 threat landscape in which attackers use AI models and agentic AI to find, weaponize, and exploit vulnerabilities at machine speed, outpacing manual remediation. Qualys positions its Enterprise TruRisk Management (ETM) and Policy...
Microsoft's August 2022 Patch Tuesday fixed 121 vulnerabilities, 17 of them critical, including two zero-days (CVE-2022-34713 and CVE-2022-30134) with one actively exploited in attacks. Microsoft also released 20 Edge (Chromium-based) updates on August 5,...
Qualys published a technical analysis of the AsyncRAT command-and-control framework, a remote access trojan offering keylogging, audio/video recording, info-stealing, remote desktop control, password recovery, remote shell, webcam access and payload...
The Questions for Confluence app creates a user account with hardcoded credentials - username disabledsystemuser and password disabled1system1user6708 - stored in the default.properties file inside the confluence-questions-X.X.X.jar file, and adds that...
Qualys VMDR won the Best Vulnerability Management Solution category in the 2022 SC Awards, was named an industry-leading solution in GigaOm's Q3 2022 Radar for Continuous Vulnerability Management, and ranked #1 in Risk-Based Vulnerability Management on the...
Qualys describes its Policy Compliance product as a way to detect and mitigate zero-day vulnerabilities through compensating controls, since patches can take days, weeks, or months to arrive. The post cites roughly 58 zero-day vulnerabilities reported in...
WhatsApp has patched critical and high-severity vulnerabilities across WhatsApp and WhatsApp Business on Android and iOS, including CVE-2022-36934, a remote code execution flaw with a CVSSv3 score of 9.8, and CVE-2022-27492, an RCE flaw scored 7.8 that...
Qualys introduced VMDR 2.0 with TruRisk, a scoring system that combines CVSS, EPSS, CISA KEV status, exploit code maturity, threat-actor and ransomware activity, dark web and GitHub sightings, and asset context into a Qualys Detection Score ranging from 1...
Microsoft's October 2022 Patch Tuesday fixed 84 vulnerabilities, 13 of them critical, including two zero-days of which CVE-2022-41033 was actively exploited. Microsoft did not release fixes for the two actively exploited Exchange zero-days tracked as...
Qualys Cloud Platform is now available for IBM zSystems and LinuxONE, bringing vulnerability management, policy compliance, and asset management to mainframes via a single lightweight Cloud Agent that uploads only deltas to keep network usage low. Qualys...
Qualys announced TotalCloud with FlexScan, a cloud-native security solution that combines Cloud Security Posture Management and Cloud Workload Security into a unified view, using agent-based and agentless assessment that automatically scans new workloads...
Microsoft's November 2022 Patch Tuesday fixed 65 new vulnerabilities, ten of them critical and allowing denial of service, elevation of privilege, and remote code execution, and addressed six known exploited zero-day flaws. Adobe released no advisories at...
Qualys Threat Research Unit discovered CVE-2022-3328, a race condition in snap-confine, a SUID-root program installed by default on Ubuntu, introduced in February 2022 by the patch for CVE-2021-44731. Qualys exploited it on Ubuntu Server by chaining it...
Qualys reports that 51% of vulnerabilities classified by CVSS were rated high or critical, even though less than 3% of all vulnerabilities cause the most risk, and that vulnerabilities now weaponize on average 2x faster than vulnerability management teams...