The O’Brien Media Digital Insider Blog

A new ransomware campaign is targeting Google Chrome users.  If Chrome users visit a compromised site, an alert will pop up prompting the user to “update” a Chrome font extension.  The false update claims it need to execute because Hoefler Text is not found.  Although this text font is legitimate, the update is not.

At the end of January, WordPress 4.7.2 was released to fix four security issues, three of which were disclosed at the time of the release. The fourth and most critical issue, an unauthenticated privilege escalation vulnerability in a REST API endpoint, was fixed silently and disclosed a week after the release. This vulnerability allows anyone with the right know-how to edit the content of your site without needing a valid username and password.

If you haven’t yet updated to 4.7.2 and your site is running 4.7.0 or 4.7.1, you are at risk for content injection.