[Security News] CISA Adds WebLogic Flaw to KEV as Exploits Spread (6.1)

CISA added Oracle WebLogic Server CVE-2024-21182 to its exploited-vulnerability catalog, while separate June 1 reports pointed to WordPress plugin abuse,…

CISA Adds WebLogic Flaw to KEV as Exploits Spread (6.1)

Overview

CISA added Oracle WebLogic Server CVE-2024-21182 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation.
feeds.feedburner.com reported active exploitation attempts against WP Maps Pro, a WordPress plugin sold more than 15,000 times on Envato Market.
feeds.feedburner.com described a malicious npm supply-chain campaign using codexui-android, a package promoted as an OpenAI Codex remote web UI with more than 29,000 weekly downloads.
feeds.feedburner.com reported that Operation Dragon Weave used spear-phishing emails with ZIP attachments against targets in the Czech Republic and Taiwan.

CISA puts exploited WebLogic flaw on the federal deadline list

CISA added CVE-2024-21182, an Oracle WebLogic Server vulnerability, to its Known Exploited Vulnerabilities catalog on June 1. The agency said the listing was based on evidence of active exploitation, which moves the flaw from a patch-management concern into an operational deadline for federal civilian agencies.

The alert identifies the affected product family as Oracle WebLogic Server and describes the issue only as an unspecified vulnerability. CISA did not provide exploit mechanics in the alert, and that restraint matters. For defenders, the actionable point is the KEV listing itself: the agency has confirmed exploitation in the wild, and federal agencies covered by Binding Operational Directive 22-01 must remediate by the assigned due date.

NIST remains the reference point for CVE records and severity metadata, while Microsoft and Google maintain their own official security update and disclosure channels. In this case, however, the strongest available June 1 signal is CISA's KEV action. Organizations running WebLogic should identify exposed instances, check Oracle patch status through official advisories, and apply compensating controls where patching cannot happen immediately.

▸ WebLogic KEV deep dive

The important context is not that another enterprise middleware flaw exists. It is that CISA moved CVE-2024-21182 into the catalog reserved for vulnerabilities with observed exploitation. That status changes the decision path for security teams. A vulnerability in a complex server product can sit in a backlog when exposure is limited, but KEV inclusion normally pushes it into emergency or accelerated remediation queues.

Oracle WebLogic Server often sits close to business applications, identity flows, and internal service layers. That placement raises the cost of delayed patching. Even without public exploit details in the provided alert, defenders can act on the known exposure pattern: inventory externally reachable WebLogic assets, confirm versions, restrict management access, and review logs for unusual authentication, deployment, or administrative activity.

The absence of a CVSS score in the supplied material should not be read as low severity. CISA's active-exploitation threshold carries a different kind of weight. CVSS estimates technical severity under defined conditions; KEV inclusion records real-world use. When both are available, teams should consider both. When only KEV status is in hand, the safer operational reading is that exploitation pressure already exists.

The federal angle also matters outside government. Binding Operational Directive 22-01 directly applies to Federal Civilian Executive Branch agencies, but private organizations often use the KEV catalog as a practical prioritization list. It gives patch managers a defensible answer to a common question: which of many open vulnerabilities should move first?

For mitigation, the clean path is vendor patching after confirming affected WebLogic versions. Where immediate patching is blocked, teams should reduce exposure, segment affected servers, limit administrative interfaces, and increase monitoring. Those steps do not replace a fix. They buy time while change windows, application testing, and vendor guidance catch up.

WP Maps Pro exploitation targets WordPress administrator access

feeds.feedburner.com reported that attackers were attempting to exploit a critical flaw in WP Maps Pro, a WordPress plugin used to embed customizable Google Maps and OpenStreetMap features. The report said the plugin had more than 15,000 sales on Envato Market, giving the issue a meaningful installed-base concern even though the supplied excerpt does not include a CVE identifier or CVSS score.

The reported attacker objective was direct and serious: creating malicious administrator accounts on susceptible WordPress sites. That outcome matters more than the plugin's mapping function. Administrator access can let an intruder change content, install additional plugins, add persistence, steal site data, or use the site as infrastructure for later abuse.

The practical response is straightforward. Site owners should determine whether WP Maps Pro is installed, confirm whether a fixed version is available from the vendor, update immediately if a patch exists, and remove the plugin if it is unused. Administrators should also audit recently created accounts, review plugin changes, rotate credentials for privileged users, and check web server logs for suspicious requests tied to plugin endpoints.

▸ WP Maps Pro deep dive

WordPress plugin vulnerabilities become high-risk quickly because they combine broad deployment with uneven maintenance habits. Many small businesses and publishers install plugins for a single site feature, then rarely revisit them unless the feature breaks. A maps plugin can therefore become part of a site's trusted attack surface long after the original administrator has stopped paying attention to it.

The reported abuse path, creation of administrator accounts, points to account-control risk rather than simple page defacement. Once an attacker has admin-level WordPress access, cleanup becomes harder. Removing one malicious user may not be enough if the intruder has already installed another plugin, changed theme files, added scheduled tasks, or created a backup path through another account.

The lack of a CVE number in the supplied excerpt is a reporting limitation. Security teams should not invent one or attach a severity score without vendor or database confirmation. Instead, they should treat the operational facts as enough to justify immediate triage: active exploitation attempts, a critical flaw, and a route to admin account creation.

The 15,000 sales figure also needs careful interpretation. Sales are not the same as active installations. Some buyers may no longer use the plugin, while others may run it on multiple sites. Still, the number signals that this is not an obscure one-off component. Managed WordPress providers, agencies, and internal web teams should search across all maintained sites rather than checking only their most visible domains.

Mitigation should pair patching with account review. If attackers are already trying to create admin accounts, a successful compromise may remain even after the vulnerable plugin is updated. The minimum follow-up is to list all administrator users, confirm their owners, revoke unknown accounts, and rotate passwords or application credentials. For higher-risk sites, teams should compare plugin and theme files against known-good copies and review outbound traffic for signs of persistence.

Malicious codexui-android package puts developer tokens at risk

feeds.feedburner.com reported a supply-chain campaign involving codexui-android, a package advertised on GitHub and npm as a remote web UI for OpenAI Codex. The report said the package attracted more than 29,000 weekly downloads and targeted developers using OpenAI Codex through what appeared to be a legitimate tool.

The central risk is credential theft. The headline says OpenAI Codex authentication tokens were stolen, and the supplied evidence states that researchers disclosed a malicious supply-chain campaign. For teams using AI-assisted development tools, that places developer workstations, local tokens, and repository access in the same risk conversation as traditional npm dependency hygiene.

The immediate response is to identify whether codexui-android was installed in developer environments, revoke and rotate exposed OpenAI-related credentials, and inspect package-lock files, shell history, npm caches, and CI images. Organizations should also review whether any token had broad repository, billing, or automation privileges beyond the single tool workflow.

▸ codexui-android deep dive

This incident fits a familiar pattern in developer supply-chain abuse: attackers wrap a harmful package in a plausible productivity story. A remote web UI for a popular development assistant sounds useful, especially for engineers who want easier access across devices or sessions. That appeal lowers friction and can draw downloads before security teams notice the package.

The figure of more than 29,000 weekly downloads is significant because developer tools often spread through informal recommendation. One engineer may test a package locally, another may add it to a shared setup script, and a third may bake it into a container image. Once that happens, the blast radius is no longer limited to the person who first installed the package.

Token theft also changes the investigation. A compromised package may leave few obvious signs after installation, but stolen authentication tokens can be used from outside the original machine. Teams should therefore treat remediation as both endpoint cleanup and credential containment. Removing the package addresses one path of exposure. Revoking tokens addresses the part of the incident that may already have left the environment.

The supplied material does not include exploit code, package internals, or a vendor advisory. That limits technical certainty, but it does not block prudent response. Security teams can search for the package name in npm logs, developer onboarding scripts, dotfiles, dependency manifests, and CI build records. They can also look for unusual access patterns tied to OpenAI services, source repositories, or developer automation around the time of installation.

The broader lesson is that AI developer tooling now belongs in software supply-chain governance. Packages that touch coding agents, authentication tokens, local repositories, or browser sessions should receive the same scrutiny as build tools and deployment helpers. A useful review question is simple: if this package turned malicious, what credential could it read, and what system could it reach next?

Dragon Weave uses ZIP phishing against Czech and Taiwan targets

feeds.feedburner.com reported that a China-aligned cyber-espionage campaign, Operation Dragon Weave, targeted officials and citizens in the Czech Republic and Taiwan. The report cited Seqrite Labs and said the campaign sought to deliver an AdaptixC2 agent through spear-phishing emails containing ZIP attachments.

The listed target sectors included government, research, academic, technology, and financial services organizations. That mix suggests collection value rather than opportunistic crime. The supplied evidence does not establish victim counts, confirmed compromises, or technical indicators beyond the phishing and delivery outline.

For defenders, the first control point is email handling. Organizations in the named regions and sectors should review recent ZIP attachments, tune detection for suspicious archive delivery, and reinforce reporting paths for targeted messages. Security teams should also check endpoint telemetry for unexpected command-and-control tools and investigate any unusual execution chain following archive extraction.

▸ Dragon Weave deep dive

Espionage campaigns often begin with ordinary-looking documents and archives because the technique still works. Spear phishing gives attackers a way to tailor language, timing, and subject matter to a narrow audience. A ZIP attachment can hide the final payload behind a file-opening routine that feels normal to a busy employee.

The target list matters. Government, research, academia, technology, and financial services all hold information that can support political, economic, or strategic intelligence goals. The Czech Republic and Taiwan also sit in geopolitical contexts where diplomatic, technological, and policy information may be valuable. That does not prove a specific sponsor from the supplied evidence, but it explains why these sectors would be attractive.

AdaptixC2 is described in the report as the agent delivered by the campaign. Command-and-control agents are used after initial access to manage compromised systems, issue tasks, and move through later phases of intrusion activity. Defenders should avoid focusing only on the email. The more important question is whether any endpoint ran a suspicious payload after a user handled an archive.

The provided source excerpt gives a campaign name and delivery method but not a complete technical report. That means response should stay evidence-based. Teams can search for recent ZIP-based phishing, compare endpoint process trees around archive extraction, and review network connections from user machines. They should not assume compromise solely from receiving a message, but they should investigate any execution event that follows the delivery pattern.

This campaign also reinforces a practical training point. Users do not need to understand every malware family to report suspicious targeted email. They need clear internal guidance on unexpected archives, requests tied to sensitive work, and messages that pressure them to open attachments quickly. For high-risk teams, attachment isolation and sandboxing are stronger than awareness training alone.

Morning Breaking Updates

feeds.feedburner.com: Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm - A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and d

▸ More — additional context and sources

The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools

Reported by feeds.feedburner.com. Three years ago, the practical question for an MSP building a cybersecurity practice was which "vCISO platform" to buy.

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

Reported by feeds.feedburner.com. A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic an…

OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack

Reported by feeds.feedburner.com. Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex th…

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More

Reported by feeds.feedburner.com. Monday hit like a cron job with anger issues.

Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

Reported by feeds.feedburner.com. Threat actors are attempting to actively exploit a critical security flaw impacting WP Maps Pro, a WordPress plugin that has had over 15,00…

CISA Adds One Known Exploited Vulnerability to Catalog

Reported by cisa.gov. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

At a glance

Fact	Publisher	Source
CISA added CVE-2024-21182 to KEV based on evidence of active exploitation.	cisa.gov	cisa.gov
BOD 22-01 requires FCEB agencies to remediate KEV-listed flaws by the due date.	cisa.gov	cisa.gov
WP Maps Pro has had more than 15,000 sales on Envato Market.	feeds.feedburner.com	thehackernews.com
codexui-android was promoted on GitHub and npm and drew over 29,000 weekly downloads.	feeds.feedburner.com	thehackernews.com
Operation Dragon Weave targeted Czech Republic and Taiwan users with ZIP-based spear phishing.	feeds.feedburner.com	thehackernews.com
NIST provides CVE records and severity metadata through the National Vulnerability Database.	NIST	nvd.nist.gov

FAQ

Q1. What is CVE-2024-21182, and why did it matter on June 1?

A. CISA identified CVE-2024-21182 as an Oracle WebLogic Server vulnerability and added it to KEV after evidence of active exploitation. The supplied CISA alert does not include a CVSS score, but KEV status makes it a priority remediation item.

Q2. Which systems face the clearest immediate exposure?

A. WebLogic deployments tied to CVE-2024-21182 and WordPress sites running WP Maps Pro carry the clearest server-side risk. feeds.feedburner.com also reported that WP Maps Pro had more than 15,000 Envato Market sales, so teams should check more than one site.

Q3. What should developers do about codexui-android?

A. Teams should search developer machines, CI images, and dependency records for codexui-android, then revoke and rotate related OpenAI Codex tokens. feeds.feedburner.com reported more than 29,000 weekly downloads, which raises the chance of informal adoption.

Q4. How does Dragon Weave differ from the plugin and npm stories?

A. Dragon Weave is described as espionage activity using spear-phishing ZIP attachments, while WP Maps Pro and codexui-android involve exposed software components. feeds.feedburner.com cited Seqrite Labs on targets across government, research, academia, technology, and finance.

Q5. What should security teams watch next?

A. Watch for Oracle remediation guidance tied to CVE-2024-21182, WP Maps Pro vendor updates, npm or GitHub action on codexui-android, and additional Seqrite Labs indicators for Dragon Weave. NIST remains useful for CVE metadata as records mature.

Sources

Last updated: 2026-06-02T14:43:24.292Z

Mini-Step

이 블로그 검색