Weekly Brief
Citrix Zero-Days Exploited and Cloudflare Cross-Tenant Flaw Fix
Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare has resolved a vulnerability in its Containers and Sandboxes that permitted Workers Paid account users to access residual data from other customers' containers on the same physical host. The cross-tenant flaw allowed for the recovery of sensitive data from shared infrastructure. The issue has been patched at the platform level.
Review logs for unusual activity if your organisation utilizes Cloudflare Workers, though the fix has already been deployed by the provider.
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA has added the Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog, mandating that US federal agencies secure their systems by Wednesday. The urgency reflects the severity of the RCE risks and the fact that they are currently being leveraged by attackers. non-federal organisations are strongly advised to follow the same timeline.
Audit all internet-facing Citrix appliances and ensure they are patched within the 48-hour window suggested by CISA's mandate.