On Tuesday, November 1, OpenSSL disclosed details of a high severity vulnerability affecting versions 3.0.0 through 3.0.6.  This vulnerability could allow remote attackers to cause a denial of service on affected systems, resulting in system outages and downtimes.  It is possible that under very specific circumstances the vulnerability could also be used to execute remote Continue Reading

On Friday, May 27, security researchers identified malicious documents taking advantage of a new zero-day exploit in Microsoft Windows (CVE-2022-30190).  The actively exploited vulnerability exists when Microsoft Windows Support Diagnostic Tool (MSDT) is called using the URL protocol from a calling application, such as Microsoft Word. By sending a specially crafted Word document that calls Continue Reading

Okta, a provider of Single Sign On (SSO) and authentication services, has confirmed that their systems were breached between January 16-21, 2022.  A data extortion group called Lapsus$ is claiming credit for the security breach and claims to have had “superuser” access to the Okta systems and their customer’s tenants.  More details of the incident Continue Reading

CMA is working closely with all of our vendors and security providers to monitor the evolving situation around the Apache Log4j vulnerability.  We will be proactively applying updates to our infrastructure and that of our managed services customers as they become available.  For our customers who manage their own IT infrastructure, we recommend reviewing this Continue Reading

On Tuesday, September 21, VMware released a patch advisory for a new remote code execution (RCE) vulnerability in VMware vCenter Server tracked as CVE-2021-22005.  Partial proof of concept (PoC) exploit code for CVE-2021-22005 has surfaced publicly and threat actors have begun to scan the internet for publicly accessible vulnerable vCenter Servers. Although the full working Continue Reading