Researchers have discovered a serious remote code execution vulnerability affecting PHP installations. As observed, this RCE flaw threatens Windows systems, thus requiring an immediate patch with the latest PHP versions.
A Simple PHP RCE Flaw Poses Severe Threat to Windows Servers
Sharing the details in a blog post, DEVCORE researchers warned users of the remote code execution (RCE) flaw in PHP that risks Windows servers.
The vulnerability is basically a bypass for a previously patched flaw, CVE-2012-1823. First reported in 2012, this 12-year-old vulnerability affected the PHP-CGI query string parameter. An unauthenticated adversary could exploit the flaw for various malicious purposes, including triggering a denial of service, viewing source code, and executing arbitrary codes. Describing the vulnerability, the advisory read,
When PHP is used in a CGI-based setup (such as Apache’s mod_cgid), the php-cgi receives a processed query string parameter as command line arguments which allows command-line switches, such as -s, -d or -c to be passed to the php-cgi binary, which can be exploited to disclose source code and obtain arbitrary code execution.
Upon discovery and bug report, the vulnerability received a fix with PHP versions 5.4.3 and 5.3.13.
However, after over a decade, DEVCORE researchers found that bypassing the patch remains possible, allowing RCE attacks. This bypass became possible due to Windows’ Best-Fit feature of encoding conversion. An adversary could enter specific character sequences to execute arbitrary codes via argument injection attack.
While DEVCORE researchers haven’t shared more details, watchTowr’s blog post elaborates on it alongside sharing the exploit. They even called it a “nasty bug with a very simple exploit.”
Patch Your Systems Now
The new vulnerability, CVE-2024-4577, affects almost all existing PHP versions, receiving a fix with PHP versions 8.3.8, 8.2.20, and 8.1.29, respectively. Typically, the researchers found Windows-based PHP installations running in the Chinese (traditional and simplified) and Japanese locales and all XAMPP installations vulnerable. Nonetheless, they believe that the flaw might also impact other locales.
Hence, users running PHP versions 8.3.x, 8.2.x, and 8.1.x earlier than the patched releases must upgrade their systems immediately to receive the fix. Besides, where an immediate system upgrade isn’t feasible, researchers advise users to deploy mitigations described in their advisory.
Google announced that effective July 8, 2024, the Fitbit.com dashboard will be replaced with the Fitbit app. Basically, this means that the web browser will no longer offer access to the web dashboard, so Fitbit users will have to fully rely on the mobile app when for tracking and management purposes.
We launched Fitbit with the Fitbit.com web dashboard to offer users a new way to interact with and log their data. Since then, we introduced the Fitbit app, a robust health and wellness app that includes the features users love about our Fitbit.com web dashboard and many other features that were exclusively developed for the app.
According to Google, the data and features of the Fitbit.com dashboard are available in the Fitbit app, but that is simply not true. There are plenty of features that many owners of Fitbit smartwatches are using right now on the Fitbit.com web dashboard that aren’t present in the mobile app.
For instance, you can’t keep track of the calories left to eat based on activity. Also, you can’t create meals or add a missed workout, just like you can’t see any pace charts. These are just some of the features that the Fitbit web dashboard offers to its users and the mobile app doesn’t.
Unfortunately, it’s unlikely that Google will add these features to the mobile app or even improve it to a point that’s actually useful, so our advice is to switch to another smartwatch brand (i.e. Garmin).
You can still access the web dashboard by choosing the ‘old look’
Now, there’s a workaround that still allows users to access the Fitbit.com dashboard, even though visiting the web page redirects them to a page that advises them to download the mobile app on their Android or iOS device.
Just below the links that send you to the mobile app on the App Store and Google Play, there’s another link that sends you to the web dashboard. Make sure to click the “If you miss the old look, head over to the browser view” link and you should be able to access the Fitbit.com web dashboard (see picture above).
The issue is that we don’t know how long this will remain live. It’s possible that Google will completely remove it on July 8, so think of it as a temporary solution.
The severity for these vulnerabilities was given as 9.8 (Critical) and 8.8 (High), respectively.
However, Microsoft has released patches and security advisories to address these vulnerabilities.
Both of these vulnerabilities were credited to Cyber Kunlun.
With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis
CVE-2024-30080: Microsoft Message Queuing (MSMQ) RCE
This vulnerability exists due to a Use-After-Free condition in Microsoft Message Queuing that could allow an authenticated threat actor to execute remote code on a vulnerable system.
However, to exploit this vulnerability, the threat actor must send a specially crafted malicious MSMQ packet to an MSMQ server, which will execute remote code on the server.
This vulnerability existed in multiple Windows Server and Windows OS versions, including Windows Server 2008, 2012, 2016, 2022, Windows 10 22H2, 21H2, and Windows 11 21H2, 22H2, and 23H2. Microsoft has categorized this vulnerability as (Critical).
CVE-2024-30078: Windows Wi-Fi Driver RCE
This vulnerability exists due to improper input validation, which could allow an unauthenticated threat actor to send malicious networking packets to an adjacent system consisting of a Wi-Fi networking adapter, resulting in remote code execution on the system.
However, to exploit this vulnerability, a threat actor must be within the target system’s range to send and receive radio transmissions.
This vulnerability also existed in multiple Windows products, including Windows Server 2019, 2022, 2008, and 2012, and Windows 10 22H2, 21H2, and Windows 11 21H2, 22H2, and 23H2.
Users of these products should upgrade their Windows to the latest versions to prevent threat actors from exploiting these vulnerabilities.
Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo
Google is trying to streamline the in-call experience in Meet by rolling out a new design that modernizes and improves the app on the surface. The so-called Material 3 Design System is now rolling out to Google Meet users across the globe, but this is just the first update that improves the look and feel of the app.The search giant announced that it will continue to release updates over the course of the next year, which will not only bring design improvements, but it will also make it easier for Google Meet users to discover and access meeting features quicker and in a more intuitive way.
This week’s update specifically changes the lower of in-call controls in Meet. As seen in the picture below, the controls now feature refreshed colors and dynamics shapes to highlight when the user is muted or when the controls are active.
Google Meet’s latest visual changes, Credits – Google
As pointed out by Google, these are just visual changes, so no functionality has been added or removed. Google Meet users should be able to see the changes in this update while using the app on the web and picture-in-picture mode.
The changes are also visible when using Meet within other apps like Docs and Slides, as well as when watching a live stream from a browser and using meeting room hardware within conference rooms.
The new design is rolling out starting today, but it will take around two weeks to reach everyone. According to Google, the changes will be available to all Google Workspace customers and users with personal Google accounts.
YouTube has just announced the Thumbnail Test & Compare functionality is now rolling out to all creators with access to advanced features. The deployment will continue over the coming weeks, so be patient if you don’t see the feature yet in the YouTube Studio segment of the app.
As the name suggests, the new feature allows YouTube creators to upload up to three video thumbnails to test with viewers to help pick a winner. Once the thumbnails are uploaded, YouTube will show them evenly across a video’s viewers, and then select a winning thumbnail based on which one generates the most watch time share.
However, YouTube says that it may take a few days or up to two weeks to get finalized results from the uploaded thumbnails. This is affected by a wide range of factors including the amount of impressions videos get and how different the thumbnails are.
When the test is complete, YouTube creators should see a “Winner” label, especially if a thumbnail clearly outperformed the other ones. If there’s no clear winner, the first thumbnail will be selected and shown to the audience.
If you’re a YouTube creator, keep in mind that this test is optional, which means that regardless of test results, you can always manually select the video thumbnail you want to use even if it wasn’t the winning option.
Unfortunately, this is only available on YouTube Studio on a computer, although YouTube says that it will explore the possibility of bringing it on mobile devices. It’s also important to mention that creators can only test thumbnails on public long-form videos, live stream archives saved as videos, or on podcast episodes.
Also, it’s not possible to test thumbnails on videos that are set as for “Made for Kids,” videos made for mature audiences, or on private videos.
YouTube creators can make sure they can use this feature by going to the “Feature eligibility” section in the channel setting in Studio and checking if they see “Enabled” next to the “Advanced features” section.
The Pixel Fold 2 and Pixel 9 have shown up in a few renders from a case manufacturer, detailing what both phones will probably look like from a design standpoint. It’s worth pointing out that this isn’t the first time that these phones have shown up in renders. Both devices have appeared in leaked CAD renders before. The main difference here is that the renders are coming from a case manufacturer so you can see what those cases look like while on each device.
However, they still add to the evidence that these are likely the final designs for Google’s upcoming devices. The renders come from accessory manufacturer Thinborne (spotted by GizChina). Thinborne will be releasing at least one case type for these phones – a ‘Thin case’ using 600D Aramid Fiber with MagSafe compatibility. In addition to the designs popping up again, Thinborne also appears to be suggesting multiple variants of the Pixel 9.
The Pixel 9 case renders point to three different models
It was expected that Google would release a new Pixel 9 standard and a Pixel 9 Pro. It’s been doing this with the last three generations of Pixel phones since the Pixel 6. But new details on Thinborne’s shop page for Google cases suggest Google will also be releasing a “Pixel 9 Pro XL” model.
Google used to use “XL” in the name of its Pixel devices but stopped after the Pixel 4 series. With the Pixel 5, it only released the standard model before launching the Pixel 5a as the more budget-friendly option. Then with the Pixel 6, it swapped the XL label for the Pro label. This sort of made more sense given the additional features and the larger screen. Whereas XL really only suggested the larger screen.
It seems Google may be moving back to including an XL model for its phones. However, it isn’t quite clear if that is accurate. Or what the differences between the Pro and Pro XL might be if Google is indeed releasing both in addition to the standard Pixel 9. It is worth reiterating that the Pixel 9 Pro XL rumor has popped up before as well. So this is just additional evidence that it may be coming.
Google has begun testing Android 15’s automatic theft detection features, starting from Brazil. Smartphone theft is one of the major concerns in many countries including Brazil where approx. 2 phones get stolen per minute. That’s why Google tapped into Brazil as its initial ground for testing the automatic theft detection features it announced at the I/O conference last month.
Google begins testing of Android 15’s automatic theft detection feature in Brazil
The automatic anti-theft features fall under the umbrella of larger privacy and security improvements Google is planning with Android 15. Not to forget, there are some other features too like a password-locked vault which Google calls “private space.” The name itself speaks for its function, users can use it to keep their sensitive data safe and secure. However, the theft detection feature for Android that has undergone testing in Brazil as a part of Android 15 is a bit different.
The anti-theft detection feature has its Google-version name, the company terms it as “Theft Detection Lock.” So, you must be wondering what goes behind this security feature that tackles smartphone theft, right? First of all, the automatic theft detection feature uses Google’s AI. Using artificial intelligence, the new anti-theft feature detects if someone has snatched your phone from your hand. And, if the feature determines the movement associated with theft, it will immediately lock the device’s screen.
Different sensors in your Android smartphone help determine if there’s any theft attempt
One must be wondering how the automatic theft detection feature can detect all the movement and stuff. Well, all that is possible, thanks to different sensors in your Android smartphone like a gyroscope and accelerometer. Based on the changes in the smartphone’s positioning and motions, Google’s algorithm can predict that the device has been snatched.
That said, there’s another possibility to it as well. In addition to relying upon smartphone sensors, the feature can also detect theft attempts if someone tries to use the device in a different network altogether. Lastly, the new anti-theft feature is available for beta testing in Brazil.
Both OPPO and Huawei launched very powerful flagship smartphones this year. We’re here to compare those phones, the OPPO Find X7 Ultra vs Huawei Pura 70 Ultra. OPPO’s handset arrived back in January, while Huawei’s launched in April. Do note that only Huawei’s phone comes in a global variant, the OPPO Find X7 Ultra does not. On the flip side, the Huawei Pura 70 Ultra does come with support for Google Play Services, it has its own services. Installing the Google Play Store on the OPPO Find X7 Ultra is easy, and once you do that you do get full support for Google services. Just in case you’re planning to import it.
Having said that, we’ll first list the specs of both smartphones and will then compare them across a number of other categories. We’ll check out the designs of both smartphones, their displays, performance, battery life, camera performance, and audio output. These two phones are both camera-focused, and both are quite powerful. They’re also very different in comparison, though. Let’s get to it!
Specs
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra, respectively
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra: Design
The design differences between these two phones are immediately noticeable. Both of these phones have a centered display camera hole at the top of their displays. The OPPO Find X7 Ultra comes with a curved display, while the Huawei Pura 70 Ultra has a flat display with quad-curved glass on top of it. Both devices do have very thin bezels around their displays. Their physical buttons sit on the right-hand side, while the OPPO Find X7 Ultra also has an alert slider, but it’s located on the left side.
Now, both of these devices do come with a frame made out of metal. Huawei’s handset has vegan leather aka eco-leather on the back, while OPPO’s combines eco-leather with glass. The top third of the phone’s backplate is covered by glass, while the rest is taken by eco-leather. The OPPO Find X7 Ultra has a large camera oreo on the back, and it’s centered. The Huawei Pura 70 Ultra has a camera island in the top-left corner. Its camera island sure does look unique.
The OPPO Find X7 Ultra’s backplate curves towards the sides, proportionally to its display on the front. The Huawei Pura 70 Ultra’s back side is quad-curved, proportionally to its display. The OPPO Find X7 Ultra is the more slippery one of the two phones. Not by much, but it’s worth noting. The Huawei Pura 70 Ultra’s quad-curved design actually provides plenty of grip, in combination with vegan leather.
The OPPO Find X7 Ultra is slightly taller and wider (barely), while also being a bit thicker than Huawei’s phone. The two devices are almost identical in terms of weight, as the difference is only 5 grams. The Huawei Pura 70 Ultra is slightly heavier. Both phones do come with an IP68 certification for water and dust resistance.
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra: Display
The OPPO Find X7 Ultra includes a 6.82-inch QHD+ (3168 x 1440) LTPO AMOLED display. That panel is curved, and it can project up to 1 billion colors. Dolby Vision and HDR10+ are also supported, while this display has an adaptive 120Hz refresh rate. The theoretical peak brightness of this display is 4,500 nits, though you’ll never be able to go that high. The screen-to-body ratio is around 90%, while the Gorilla Glass Victus 2 protects this panel.
OPPO Find X7 Ultra
The Huawei Pura 70 Ultra, on the other hand, has a 6.8-inch 2844 x 1260 LTPO OLED panel. That display is flat. It can project up to 1 billion colors, and HDR is supported. It has an adaptive refresh rate of up to 120Hz. The peak brightness of this panel is 2,500 nits. The screen-to-body ratio is around 89%. The Huawei Pura 70 Ultra’s display is protected by the Kunlun glass (Basalt-tempered).
Both of these displays are outstanding. They’re not only well-protected, but they are also vivid and have great viewing angles. The blacks are deep, while both panels are more than sharp enough. The touch response is good on both sides, while both panels do get more than bright enough regardless of where you use them. Both devices also offer high-frequency PWM dimming to protect your eyes. You’ll be fine regardless of which panel you end up using, they’re both great.
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra: Performance
OPPO’s flagship is fueled by the Snapdragon 8 Gen 3 processor. That is a 4nm chip. OPPO included up to 16GB of LPDDR5X RAM inside the device, and it’s also using UFS 4.0 flash storage. The Huawei Pura 70 Ultra, on the flip side, is fueled by the Kirin 9010 chip. That is Huawei’s 7nm processor made by SMIC. The phone includes 16GB of LPDDR5X RAM, and UFS 4.0 flash storage is also included.
The Huawei Pura 70 Ultra does come with an inferior chip. The main reason for that is the US ban. Still, the phone is really well-optimized and works really well with that processor. In fact, you wouldn’t even be able to tell that it has a noticeably inferior chip based on everyday performance. Both smartphones offer great performance, they can handle anything you throw at them. They’re great for browsing, multimedia consumption, multitasking, image processing, and anything else you can think of.
You’ll notice the difference in the gaming department. Especially if you end up playing a really demanding game. Games that are not that demanding will run fine on both phones. Those demanding ones will definitely work better on the OPPO Find X7 Ultra, mainly due to its processor. For everything else, both will do just fine.
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra: Battery
A 5,000mAh battery sits inside the OPPO Find X7 Ultra. The Huawei Pura 70 Ultra, on the other hand, includes a 5,200mAh unit. You’ll be glad to know that both of these phones do offer really good battery life. In our usage, the Huawei Pura 70 Ultra did do better, though, and the same goes for our battery drain test. The OPPO Find X7 Ultra was not far behind, though, as it also provided some great numbers.
We were able to cross the 7-hour screen-on-time mark on both smartphones without much trouble. Do note that gaming was not a part of our usage on those days, but we did not baby either phone. Both of them also held their own while being connected to mobile data. Both of them also had charge left in the tank at that point, usually close to 20%. Well, the Huawei Pura 70 Ultra did have a bit more. Your mileage may vary, though, of course. In fact, it probably will. There are a ton of factors when it comes to battery life, so… keep that in mind.
The OPPO Find X7 Ultra supports 100W wired, 50W wireless, and 10W reverse wireless charging. The Huawei Pura 70 Ultra, on the other hand, supports 100W wired, 80W wireless, 20W reverse wireless, and 18W reverse wired charging. OPPO’s flagship is not easy to beat in the charging department, but that’s exactly what the Huawei Pura 70 Ultra did, technically. It offers slightly faster wired and wireless charging, while it’s also more versatile when it comes to charging. Both smartphones do come with a charger included in the retail box.
OPPO Find X7 Ultra vs Huawei Pura 70 Ultra: Cameras
You’ll find four cameras on the back of the OPPO Find X7 Ultra. The Huawei Pura 70 Ultra has three of them. A 50-megapixel main camera is backed by a 50-megapixel ultrawide unit (123-degree FoV) on the Find X7 Ultra. A 50-megapixel periscope telephoto camera (2.8x optical zoom) is also included, as is a second 50-megapixel periscope telephoto unit (6x optical zoom). Hasselblad is also a part of the package here, and it did a fine job tuning the colors.
Huawei Pura 70 Ultra
The Huawei Pura 70 Ultra comes with a 50-megapixel main camera (variable aperture, sensor-shift OIS, retractable lens), and a 40-megapixel ultrawide unit. A 50-megapixel periscope telephoto camera (3.5x optical zoom, macro) is also included. Both of these smartphones offer outstanding camera performance, and both are amongst the best camera smartphones available in the market.
OPPO’s flagship tends to provide a bit more contrasty shots, while the Huawei Pura 70 Ultra does its best to keep things closer to real life. It does add a warm tone to images. Images from both smartphones do end up looking vivid, though. They both do a fantastic job with demanding HDR shorts. They also shine in low light, as they manage to balance out images while keeping noise in check. Their secondary cameras keep up when it comes to color science. We did prefer the performance of OPPO’s ultrawide shooter in low light, though. Generally, though, these two phones both did a fantastic job and are basically on par in terms of camera performance.
Audio
You’ll find stereo speakers on both of these phones. The thing is, the ones on the OPPO Find X7 Ultra are noticeably louder. With that being said, both sets are well-balanced and offer quality sound output.
What you won’t find on either phone is an audio jack. You can always utilize their Type-C ports for wired audio connections, however. If you prefer to go wireless, however, the OPPO Find X7 Ultra supports Bluetooth 5.4, while the Huawei Pura 70 Ultra comes with Bluetooth 5.2 support.
HTC is readying the reveal of its next phone, which the company is slated to announce officially on June 12, but ahead of the event tomorrow the HTC U24 Pro design appears to have leaked. In addition to the design, all of the specs appear to be available as well.
HTC teased the coming of a new ‘U’ phone back on June 7. At the time it didn’t confirm what the model was. The company did however tease it with an image that said “All 4 U“. The key takeaway from that teaser was that the second “L” in the word ‘all’ and the “4” were squished together and they were both a separate color from the rest of the phrase. Hinting very obviously that this upcoming phone reveal is for the U24 Pro.
The HTC U24 Pro leak shows the phone design in a brilliant blue color
There are a few things to note about this phone’s design. It comes in a stunning blue color, it has curved glass for the display, and it’s got three cameras on the back. Some of those things may or may not make the phone stick out for you. What’s more intriguing is the pairing of the design and the specs.
GSMArena has listed what appear to be the full specifications (spotted by DroidLife). According to the specs listing, the HTC U24 Pro comes with a 6.8-inch display with a resolution of 1080 x 2400. It has 256GB of storage and comes with 12GB of RAM as well as a 5,000mAh battery. Without going any further, the HTC U24 Pro will already likely sound appealing to some based on these factors. But it gets better.
The display is also an OLED panel and it has a 120Hz refresh rate. Which means good things for both gaming and general use. Because scrolling around the phone should appear more fluid with little to no snags. As for the processor, it’s listed as coming with a Snapdragon 7 Gen 3. That’s no slouch of a chipset. It’s not a flagship mobile platform but the phone should still perform just fine.
The cameras sound somewhat impressive too. With the triple camera arrangement on the back, HTC went with a 50MP main camera in pairing with a 12MP telephoto lens that has 2x optical zoom, and an 8MP ultrawide camera. On the front, it’s using a 32MP selfie camera.
The phone will cost “about €450”
It was already rumored that HTC wasn’t bringing this phone to the US, and that may hold true. There’s no mention of availability in the specs listing but there is a brief mention of the price. It’ll cost about €450 which means it should be launching in Europe sometime in the near future. With HTC planning to unveil the phone tomorrow, chances are availability and official pricing will be announced at the same time.
For months, it has been rumored that Spotify will launch a new plan with superior audio quality this year. Now, a new leak reveals the possible price of Spotify’s Hi-Fi tier, and it looks like it won’t be cheap.
Spotify had already officially confirmed that they would launch a Hi-Fi plan. However, the company said it in 2021, so it’s been quite some time. It is not known why the arrival of the new plan has taken so long. But it seems that 2024 will be the year when the service will receive the long-awaited tier. That said, according to a recent leak, it would cost at least $5 extra over your current plan.
Enjoying Hi-Fi audio on Spotify would cost $16–$17/month in the US
According to the Bloomberg report, Spotify’s Hi-Fi plan would actually be an add-on for the premium plans. This means that the final price you will pay depends on the base plan you have. The add-on in question would cost around 40% more than your current paid tier. The percentage may vary slightly due to price differences between different regions.
Currently, in the United States, Spotify Premium subscribers pay $11.99. So, if the leak holds true, enjoying lossless audio quality would have a monthly cost of $16–$17. Taking into account the current market, the offer does not seem too attractive on paper. There are services like Amazon Music ($9,99), Apple Music ($10,99), and Tidal ($10,99) that include Hi-Fi audio as an integral part of their premium plans.
Hi-Fi add-on would include generative AI features for playlists
Spotify would seek to justify the potentially high price of its Hi-Fi plan with AI-powered playlist creation tools. The company has already been experimenting with the Spotify DJ feature. According to the report, paying for the Hi-Fi add-on would also allow you to generate playlists or mixes for specific activities or dates. Everything would be generated according to your specific musical tastes.
The company would also seek to use the social section as a selling point. Every year, millions of users around the world share their Spotify Wrapped summary on social networks. The company would take advantage of this to make moves in favor of its Hi-Fi plan. Be that as it may, price can be a fundamental factor in its success or failure. Having a cost well above the vast existing competition would be a risky move.
