The Exploit Bulletin

How to Test

Check the running Gitea version (admin panel or `gitea --version`) and whether the image is <= 1.26.2; inspect the container app.ini (docker/root/etc/templates/app.ini:55 or rootless:52) for REVERSE_PROXY_TRUSTED_PROXIES = * and whether ENABLE_REVERSE_PROXY_AUTHENTICATION is true; test with `curl -s -L -H "X-WEBAUTH-USER: <existing_user>" http://host:3000/` and see if you are logged in as that user.

How to Patch

Upgrade to Gitea 1.26.3/1.26.4 (or 1.27.1), which removes REVERSE_PROXY_LIMIT/REVERSE_PROXY_TRUSTED_PROXIES from the Docker templates; as a stop-gap, set REVERSE_PROXY_TRUSTED_PROXIES to your proxy's address (e.g. 127.0.0.0/8,::1/128) or disable ENABLE_REVERSE_PROXY_AUTHENTICATION.

How to Test

Check the installed Plex Media Server build in the server settings/about screen; any build below 1.43.3.10861 is affected. Determine whether the server is reachable from the internet (remote access enabled or a forwarded port). On affected servers, look for unexpected cryptocurrency-miner or proxy processes running under the Plex service account, unexpected newly written files in the Plex application/data directories, and unusual API requests from external addresses in the server's access logs.

How to Patch

Upgrade Plex Media Server to 1.43.3.10861 or later. App-store builds (e.g. QNAP) may lag behind the direct download; until the fixed build is installed, remove the server from internet exposure by disabling remote access and closing the forwarded port.

How to Test

On every firewall that hosts a GlobalProtect portal or gateway, compare the running PAN-OS version against the fixed builds listed above and check whether authentication override cookies are enabled, the configuration Palo Alto Networks lists, together with a specific certificate configuration, as required for exposure; for Prisma Access, confirm with Palo Alto Networks that your tenant has been moved to 11.2.7-h13 or 10.2.10-h36 or later under their upgrade schedule. Review GlobalProtect portal and gateway logs for VPN sessions from unexpected users or source addresses and for sessions that completed without the expected MFA step; any such session on a device that was unpatched is a potential intrusion precursor, so hunt internal hosts reachable from the VPN address pool for follow-on Qilin or INC ransomware activity.

How to Patch

Upgrade PAN-OS to a fixed build: 12.1.4-h6 or 12.1.7 and later; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later. Prisma Access is fixed in 11.2.7-h13 and 10.2.10-h36 and is being upgraded by Palo Alto Networks per the schedule shared with customers; confirm your tenant has received it.