Tech
SolarWinds RCE bug makes Cisa list as exploitation spreads | Computer Weekly
A critical vulnerability in SolarWinds’ Web Help Desk service has been added to the US Cybersecurity and Infrastructure Security Agency’s (Cisa’s) Known Exploited Vulnerabilities (Kev) catalogue as exploitation spreads in the wild.
CVE-2025-40551 was among six common vulnerabilities and exposures (CVEs) disclosed by SolarWinds in an advisory at the end of January. It arises from Common Weakness Enumeration (CWE) 502 – deserialisation of untrusted data, and left unaddressed, enables an attacker to achieve remote code execution (RCE) on the target system.
The five other flaws listed in SolarWinds 28 January advisory are: CVE-2025-40552, an authentication bypass vulnerability; CVE-2025-40553, another RCE flaw arising from deserialisation; CVE-2025-40554 a second authentication bypass; CVE-2025-40536, which enables attackers to bypass access controls; and CVE-2025-40537, which may enable privilege elevation. All bear either high or critical Common Vulnerability Scoring System (CVSS) markers.
An update from SolarWinds taking Web Help Desk to version 2026.1 has since fixed all six issues.
In his analysis, researcher Jimi Sebree of Horizon3.ai, who discovered CVE-2025-40551 in early December, described it as “easily exploitable” and encouraged users to update as soon as possible, especially since it can be exploited without authentication.
“Attackers don’t always need ‘zero-day’ magic when they can just lean on reliable, low-complexity techniques like deserialisation. These flaws get buried in trusted, boring platforms like help desks, and that’s exactly why they’re so dangerous,” said Joe Brinkley, head of threat research at offensive security specialist Cobalt.
“Risks like this are often overlooked until Cisa drops a Kev notice. The real headache isn’t just the RCE; it’s the chaining. Once you’ve got unauthenticated admin access, you’re not just looking at one box, you are now looking at lateral movement and full compromise.
“We often see orgs underestimate just how fast the turnaround is from a proof of concept hitting GitHub to active exploitation. If you’re not hitting this with proactive validation and simulation now, you’re already behind the curve. Patch now,” added Brinkley.
Widely-used product
SolarWinds Web Help Desk is a helpdesk and IT service management platform that runs ticketing, asset tracking, service level agreement (SLA) management and workflow automation for IT support teams. It is well in use at organisations of many different sizes, and previous flaws discovered in the product have been swiftly weaponised by threat actors in the past, so warnings over this latest set of vulnerabilities should be heeded.
Its addition to the Cisa catalogue indicates a potential high-level of exposure within the US federal government, and obliges all bodies in scope to complete their updates in a much shorter-than-usual timeline, by Friday 6 February in this case.
Dale Hoak, chief information security officer at RegScale, a Washington DC-area governance, risk and compliance (GRC) specialist said the short remediation window reflected the speed with which operational risk escalates when vulnerabilities move from theoretical to exploited.
“Many organisations still rely on periodic assessments, which struggle to keep pace with threats that evolve in days, not months,” said Hoak. “The limitation is not awareness of vulnerabilities, but the speed at which teams can validate exposure and enforce remediation. Continuous controls monitoring helps close this gap by turning patching and configuration changes into measurable, auditable actions. That shift is critical for maintaining resilience under real-world attack pressure.”
Tech
Netflix Says if the HBO Merger Makes It Too Expensive, You Can Always Cancel
There is concern that subscribers might be negatively affected if Netflix acquires Warner Bros. Discovery’s streaming and movie studios businesses. One of the biggest fears is that the merger would lead to higher prices due to less competition for Netflix.
During a US Senate hearing Tuesday, Netflix co-CEO Ted Sarandos suggested that the merger would have an opposite effect.
Sarandos was speaking at a hearing held by the US Senate Judiciary Committee’s Subcommittee on Antitrust, Competition Policy, and Consumer Rights, “Examining the Competitive Impact of the Proposed Netflix-Warner Brothers Transaction.”
Sarandos aimed to convince the subcommittee that Netflix wouldn’t become a monopoly in streaming or in movie and TV production if regulators allowed its acquisition to close. Netflix is the largest subscription video-on-demand provider by subscribers (301.63 million as of January 2025), and Warner Bros. Discovery is the third (128 million streaming subscribers, including users of HBO Max and, to a smaller degree, Discovery+).
Speaking at the hearing, Sarandos said: “Netflix and Warner Bros. both have streaming services, but they are very complementary. In fact, 80 percent of HBO Max subscribers also subscribe to Netflix. We will give consumers more content for less.”
During the hearing, Democratic senator Amy Klobuchar of Minnesota asked Sarandos how Netflix can ensure that streaming remains “affordable” after a merger, especially after Netflix issued a price hike in January 2025 despite adding more subscribers.
Sarandos said the streaming industry is still competitive. The executive claimed that previous Netflix price hikes have come with “a lot more value” for subscribers.
“We are a one-click cancel, so if the consumer says, ‘That’s too much for what I’m getting,’ they can cancel with one click,” Sarandos said.
When pressed further on pricing, the executive argued that the merger doesn’t pose “any concentration risk” and that Netflix is working with the US Department of Justice on potential guardrails against more price hikes.
Sarandos claimed that the merger would “create more value for consumers.” However, his idea of value isn’t just about how much subscribers pay to stream but about content quality. By his calculations, which he provided without further details, Netflix subscribers spend an average of 35 cents per hour of content watched, compared to 90 cents for Paramount+.
The Netflix stat is similar to one provided by MoffettNathanson in January 2025, finding that in the prior quarter, on average, Netflix generated 34 cents in subscription fees per hour of content viewed per subscriber. At the time, the research firm said Paramount+ made an average of 76 cents per hour of content viewed per subscriber.
Downplaying Monopoly Concerns
Netflix views Warner as “both a competitor and a supplier,” Sarandos said when subcommittee chair Republican senator Mike Lee of Utah asked why Netflix wants to buy WB’s film studios, per Variety. The streaming executive claimed that Netflix’s “history is about adding more and more” content and choice.
During the hearing, Sarandos argued that streaming is a competitive business and pointed to Google, Apple, and Amazon as “deep-pocketed tech companies trying to run away with the TV business.” He tried to downplay concerns that Netflix could become a monopoly by emphasizing YouTube’s high TV viewership. Nielsen’s The Gauge tracker shows which platforms Americans use most when using their TVs (as opposed to laptops, tablets, or other devices). In December, it said that YouTube, not including YouTube TV, had more TV viewership (12.7 percent) than any other streaming video-on-demand service, including second-place Netflix (9 percent). Sarandos claimed that Netflix would have 21 percent of the streaming market if it merged with HBO Max.
Tech
The Best Super Bowl TV Deals
Upgrade your viewing setup before inviting your friends over to watch the big game.
Source link
Tech
Measles Is Causing Brain Swelling in Children in South Carolina
Some children affected by measles in the ongoing South Carolina outbreak have developed a serious complication of the disease called encephalitis, or swelling of the brain, state epidemiologist Linda Bell said on Wednesday.
The South Carolina measles outbreak began in October with a handful of infections. As of February 3, cases have climbed to 876, with 700 of those being reported since the beginning of the year. The surge could mean another bad year of measles for the United States, which had more than 2,267 cases—the highest in 30 years—in 2025. Declining vaccination rates across the country are driving the resurgence.
Encephalitis is a rare but severe complication of measles that can lead to convulsions and cause deafness or intellectual disability in children. It usually occurs within 30 days of an initial measles infection and can happen if the brain becomes infected with the virus or if an immune reaction to the virus causes inflammation in the brain. Among children who get measles encephalitis, 10 to 15 percent die.
It’s not known how many children in South Carolina have developed this serious complication. Under state law, measles cases must be reported to the South Carolina Department of Public Health, but measles hospitalizations and complications do not need to be disclosed.
“We don’t comment on the outcomes of individuals, but we do know that inflammation of the brain, or encephalitis, is a known complication of measles,” Bell told reporters during a media briefing on Wednesday. “Anytime you have inflammation of the brain, there can be long-term consequences, things like developmental delay and impacts on the neurologic system that can be irreversible.”
The department is aware of 19 measles-related hospitalizations in the state, including some due to pneumonia, which occurs in about one in 20 children with measles and is the leading cause of death for children who get measles.
Bell also said that several pregnant women who were exposed to the virus required administration of immune globulin, a concentrated solution of antibodies. It provides temporary protection against measles for unvaccinated individuals. Measles exposure during pregnancy can cause preterm birth or miscarriage.
A rarer type of brain swelling called subacute sclerosing panencephalitis, or SSPE, can occur years after a measles infection. In September, the Los Angeles County Department of Public Health reported the death of a school-age child due to SSPE. The child was originally infected with measles as an infant before they were old enough to receive the measles vaccine, the first dose of which is recommended for children between 12 and 15 months old.
After recovering from the initial measles illness, the child developed SSPE, in which the virus remains dormant in the brain before triggering an inflammatory response that destroys brain tissue over time. The condition usually appears seven to 10 years after a person appears to recover from the initial measles infection. An estimated two in 10,000 people who get measles eventually develop SSPE.
The measles, mumps, and rubella (MMR) vaccine is the best way to prevent measles and serious complications associated with it.
Over 7,000 more doses of the MMR vaccine were given statewide in South Carolina this January compared to January 2025, a 72 percent increase. In Spartanburg County, the center of the outbreak, over 1,000 more doses were given this January compared to January 2025, a 162 percent increase. So far, January was the best month for measles vaccination during the outbreak, Bell said.
-
Sports1 week agoPSL 11: Local players’ category renewals unveiled ahead of auction
-
Entertainment1 week agoClaire Danes reveals how she reacted to pregnancy at 44
-
Sports1 week agoCollege football’s top 100 games of the 2025 season
-
Business1 week agoBanking services disrupted as bank employees go on nationwide strike demanding five-day work week
-
Politics1 week agoTrump vows to ‘de-escalate’ after Minneapolis shootings
-
Sports1 week agoTammy Abraham joins Aston Villa 1 day after Besiktas transfer
-
Tech1 week agoBrighten Your Darkest Time (of Year) With This Smart Home Upgrade
-
Entertainment1 week agoK-Pop star Rosé to appear in special podcast before Grammy’s
