Month: September 2020

Enlarge (credit: StickerGiant / Flickr)

Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched.

Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site.

NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.

Enlarge / Francis Collins, director of the U.S. National Institutes of Health, reportedly objected to the FDA's decision to grant an Emergency Use Authorization to plasma treatments. (credit: Bloomberg / Getty Images)

Last week, the FDA announced that it was issuing an emergency use authorization for the treatment of COVID-19: the blood plasma of people who have recovered from a COVID-19 infection. But controversy quickly engulfed that announcement after it became clear that the head of the FDA had exaggerated the effectiveness of the treatment when explaining why it was being approved.

The FDA's salesmanship of blood plasma—which is a treatment of unknown efficacy—was taken as evidence that the emergency use authorization was the product of political pressure exerted by a Trump administration anxious to have some good news to promote its reelection campaign. Additionally, health experts at the National Institute of Health (NIH) didn't agree with the decision and had tried to block it a week ago. Now, the NIH may be striking back, releasing a document that basically says it's looked at the evidence and is not convinced.

Not so fast

While the CDC and FDA have led some aspects of the coronavirus response, the NIH is the employer of Anthony Fauci and the largest biomedical research organization in the world. So it certainly has things to say about how to handle the pandemic, and it maintains a COVID-19 Treatment Guidelines Panel. This, as its name implies, maintains guidelines on different aspects of care for the disease. So, given that the FDA has just given an Emergency Use Authorization to a treatment, it essentially forced the NIH to respond in some way.