Week of May 23, 2022: Broadcom's $61B VMware deal and GM/Zola account hijackings

Security leaders watched Broadcom's $61 billion bid for VMware reshape vendor risk calculus, while GM and Zola disclosed customer account compromises tied to credential stuffing. CISA pushed out fresh guidance and patch alerts covering 5G evaluation, Citrix, Chrome, Drupal, and a fresh batch of Known Exploited Vulnerabilities additions.

CISA and DoD publish 5G Security Evaluation Process study

CISA and the Department of Defense released a joint investigation study laying out a 5G Security Evaluation Process for federal agencies preparing to adopt low-, mid-, and high-band 5G deployments. Developed with DHS Science and Technology and DoD's Under Secretary of Defense for Research and Engineering, the study applied the process to a private 5G network use case and was positioned to support the Risk Management Framework's "Prepare" step, giving program managers a repeatable evaluation methodology for 5G-enabled systems. (CISA)

Citrix patches ADC and Gateway denial-of-service flaws

Citrix issued security updates for ADC and Gateway products after identifying vulnerabilities that an attacker could exploit to trigger a denial-of-service condition. CISA flagged the release and pointed administrators to Citrix's own advisory, CTX457048, urging organizations running the affected appliances to apply the fixes promptly given the role these products play as internet-facing access points for enterprise networks. (CISA)

CISA adds 34 vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA expanded its Known Exploited Vulnerabilities Catalog with 34 additional entries based on evidence of active exploitation, continuing enforcement under Binding Operational Directive 22-01. Federal civilian agencies faced mandated remediation deadlines for the newly listed CVEs, while CISA again urged all organizations, not just federal entities, to prioritize patching catalog vulnerabilities as part of routine vulnerability management given their demonstrated use by malicious actors. (CISA)

Google ships Chrome 102 fix for actively exploitable flaws

Google released Chrome version 102.0.5005.61 for Windows, Mac, and Linux to close vulnerabilities that could let an attacker take control of an affected system. CISA advised users and administrators to consult Google's Chrome Release Note and apply the update without delay, reflecting the browser's role as a common entry point for both mass and targeted intrusion attempts across enterprise environments. (CISA)

Broadcom agrees to acquire VMware for $61 billion

Broadcom and VMware announced a cash-and-stock agreement valuing VMware at approximately $61 billion, with Broadcom also assuming $8 billion of VMware's net debt. The deal would fold VMware's multi-cloud, networking, and security portfolio into a rebranded VMware under Broadcom's Software Group, a development security leaders needed to track given VMware's footprint across virtualization, cloud infrastructure, and enterprise security tooling used in countless corporate environments. (Help Net Security)

GM and Zola disclose credential-stuffing account compromises

General Motors notified customers that it identified suspicious logins to certain GM online accounts and recent redemption of customer reward points for gift cards that may not have been authorized, occurring between April 11 and April 29, 2022. Wedding-planning site Zola separately confirmed some user accounts were hacked over a weekend with linked bank accounts used to buy gift cards. Both companies attributed the activity to credential stuffing rather than a breach of their own systems and reset affected passwords. (Help Net Security)

Drupal issues security update for contributed-project vulnerability

Drupal released security updates addressing a vulnerability that did not affect Drupal core itself but could affect some contributed projects or custom code running on Drupal sites. CISA warned that exploitation could let a remote attacker take control of an affected website and directed administrators to Drupal's SA-CORE-010 advisory to apply the necessary fixes, a reminder for CISOs running CMS platforms to audit third-party modules alongside core software. (CISA)