Week of May 20, 2024: SEC's 30-day breach rule and the CyberArk-Venafi deal

Security leaders tracked the SEC finalizing a 30-day breach-notification rule for financial institutions and CyberArk agreeing to acquire Venafi for $1.54 billion, two moves that reshaped expectations for incident disclosure and machine-identity security. The same week, CISA added actively exploited Apache Flink, Chromium, and Mirth Connect flaws to its Known Exploited Vulnerabilities Catalog, GitHub patched a maximum-severity Enterprise Server authentication bypass, and researchers disclosed that courtroom recording software JAVS Viewer had been distributing credential-stealing malware from the vendor's own download site.

SEC Adopts 30-Day Breach Notification Rule for Financial Institutions

The Securities and Exchange Commission adopted amendments to Regulation S-P on May 20, 2024, updating rules first set in 2000 for broker-dealers, investment companies, registered investment advisers, and transfer agents. Covered institutions must now build incident response programs and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that their sensitive customer information was or was likely accessed without authorization. Larger entities get 18 months to comply; smaller entities get 24 months, starting after Federal Register publication. (Help Net Security)

CyberArk Agrees to Acquire Venafi for $1.54 Billion

CyberArk signed a definitive agreement on May 20, 2024, to acquire Venafi from Thoma Bravo for an enterprise value of approximately $1.54 billion, combining roughly $1 billion in cash and about $540 million in CyberArk shares. The deal pairs Venafi's machine identity and certificate lifecycle management with CyberArk's identity security platform, with Venafi expected to add about $150 million in annual recurring revenue. Both boards approved the transaction, which is expected to close in the second half of 2024 subject to regulatory approvals. (Help Net Security)

CISA Adds Chromium and Mirth Connect Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 20, 2024: CVE-2024-4947, a type confusion flaw in Google Chromium's V8 engine, and CVE-2023-43208, a deserialization vulnerability in NextGen Healthcare's Mirth Connect. Federal civilian agencies were directed to remediate the vulnerabilities under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching given evidence the flaws were being actively exploited by malicious actors. (CISA)

CISA Adds Apache Flink Flaw to Known Exploited Vulnerabilities Catalog

On May 23, 2024, CISA added CVE-2020-17519, an improper access control vulnerability in Apache Flink, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition triggers remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA again encouraged all organizations to factor the catalog into their vulnerability management prioritization, noting that such flaws remain frequent vectors for malicious cyber actors. (CISA)

Courtroom Recording Software JAVS Viewer Served with Backdoor Malware

Rapid7 reported that installers of JAVS Viewer, courtroom recording software from Justice AV Solutions, had been distributing loader malware tied to the GateDoor/Rustdoor family since at least early April, with a compromised installer traced to a March 5 download from the vendor's official site. Justice AV Solutions confirmed it had pulled affected versions, reset passwords, and audited its systems, stating files currently on its site were genuine, and advised users with version 8.3.7 installed to re-image affected endpoints and upgrade to 8.3.8 or later. (Help Net Security)

GitHub Patches Maximum-Severity Enterprise Server Authentication Bypass

GitHub fixed a critical, maximum-severity vulnerability, CVE-2024-4985, that could let an unauthorized attacker forge a SAML response to gain site-administrator access on GitHub Enterprise Server instances using SAML single sign-on with encrypted assertions enabled. The flaw, reported through GitHub's bug bounty program, affected all Enterprise Server versions before 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4; instances without encrypted assertions enabled were not affected. (Help Net Security)

Cisco Issues Bundled Security Advisory for ASA, FMC, and FTD Software

CISA highlighted a bundled Cisco publication released May 24, 2024, addressing multiple vulnerabilities across Cisco Adaptive Security Appliance, Firepower Management Center, and Firepower Threat Defense software. CISA warned that a cyber threat actor could exploit one of the flaws to take control of an affected system, and it urged users and administrators to review the Cisco bundle and apply the necessary updates without delay. (CISA)

ARPA-H Pledges $50 Million for Autonomous Hospital Vulnerability Management

The Advanced Research Projects Agency for Health announced the UPGRADE program on May 23, 2024, committing investment expected to surpass $50 million toward an autonomous vulnerability management platform for healthcare IT teams. The announcement followed CISA's addition of the actively exploited Mirth Connect flaw, CVE-2023-43208, to its exploited-vulnerabilities catalog, and aimed to help hospitals patch at scale despite limited IT resources and low tolerance for device downtime. Applicants can submit proposals through June 18, 2024. (Help Net Security)