{"id":1221281,"date":"2023-04-30T12:00:00","date_gmt":"2023-04-30T11:00:00","guid":{"rendered":"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/"},"modified":"2023-04-30T12:00:00","modified_gmt":"2023-04-30T11:00:00","slug":"apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired","status":"publish","type":"post","link":"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/","title":{"rendered":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws &#8211; WIRED"},"content":{"rendered":"<p> <script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- newscabal uk text -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:inline-block;width:728px;height:90px\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"3688094655\"><\/ins>\r\n<script>\r\n(adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<\/p>\n<div id=\"\">\n<div class=\"callout lead-in-text\">\n<p class=\"lead-in-text-callout\">Tech giants Apple, Microsoft, and Google each fixed major security flaws in April, many of which were already being used in real-life attacks. Other firms to issue patches include privacy-focused browser Firefox and enterprise software providers SolarWinds and Oracle.\n<\/p>\n<\/div>\n<p>Here\u2019s everything you need to know about the patches released in April.<\/p>\n<h3>Apple<\/h3>\n<p>Hot on the heels of <a href=\"https:\/\/www.wired.co.uk\/article\/ios-16-4-outlook-android-critical-update-march-2023#intcid=inline_amp\" data-vars-link-click-url=\"https:\/\/www.wired.co.uk\/article\/ios-16-4-outlook-android-critical-update-march-2023#intcid=inline_amp\" data-vars-link-type=\"Internal\">iOS 16.4<\/a>, Apple has released the iOS 16.4.1 <a href=\"https:\/\/www.forbes.com\/sites\/kateoflahertyuk\/2023\/04\/08\/ios-1641-update-now-warning-issued-to-all-iphone-users\/\" data-vars-link-click-url=\"https:\/\/www.forbes.com\/sites\/kateoflahertyuk\/2023\/04\/08\/ios-1641-update-now-warning-issued-to-all-iphone-users\/\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.forbes.com\/sites\/kateoflahertyuk\/2023\/04\/08\/ios-1641-update-now-warning-issued-to-all-iphone-users\/\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">update<\/a> to fix two vulnerabilities already being used in attacks. <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" data-vars-link-click-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-28206<\/a> is an issue in the IOSurfaceAccelerator that could see an app able to execute code with kernel privileges, Apple said on its <a href=\"https:\/\/support.apple.com\/en-gb\/HT213720\" data-vars-link-click-url=\"https:\/\/support.apple.com\/en-gb\/HT213720\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/support.apple.com\/en-gb\/HT213720\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">support page<\/a>.<\/p>\n<p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" data-vars-link-click-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28205\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-28205<\/a> is an issue in WebKit, the engine that powers the Safari browser, that could lead to arbitrary code execution. In both cases, the iPhone maker says, \u201cApple is aware of a report that this issue may have been actively exploited.\u201d<\/p>\n<figure class=\"cne cne-interlude\"><amp-iframe width=\"500\" height=\"420\" allowfullscreen=\"\" sandbox=\"allow-scripts allow-same-origin allow-popups\" src=\"https:\/\/player.cnevids.com\/interlude\/wired\/iframe\/?pageURL=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&amp;pageType=amp-article&amp;tags=security%2Cvulnerabilities%2Coperating%20systems%2Capple%2CMicrosoft%2CAndroid%2CChrome%2CFirefox%2COracle%2CCisco&amp;intcid=inline_amp&amp;hasCompanion=0&amp;analyticsUrl=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&amp;section=Security&amp;ampTargeting=%7B%22cnt_copilotid%22%3A%5B%22644c70820124a91cee27d77a%22%5D%2C%22cnt_platform%22%3A%5B%22amp%22%5D%2C%22cnt_tags%22%3A%5B%22apple-google-microsoft-zero-day-critical-update-april%22%2C%22security%22%2C%22vulnerabilities%22%2C%22operating-systems%22%2C%22apple%22%2C%22microsoft%22%2C%22android%22%2C%22chrome%22%2C%22firefox%22%2C%22oracle%22%2C%22cisco%22%2C%22cyberattacks-and-hacks%22%2C%22article-settings%22%2C%22ContentHeader%22%2C%22variation%22%2C%22TextAboveLeftSmall%22%2C%22operating%20systems%22%2C%22Microsoft%22%2C%22Android%22%2C%22Chrome%22%2C%22Firefox%22%2C%22Oracle%22%2C%22Cisco%22%5D%2C%22ctx_page_channel%22%3A%5B%22security%22%5D%2C%22ctx_page_slug%22%3A%22apple-google-microsoft-zero-day-critical-update-april%22%2C%22ctx_template%22%3A%22amp-article%22%2C%22partner%22%3A%5B%22amp%22%5D%2C%22pos%22%3A%5B%22mid-content%22%5D%2C%22pos_instance%22%3A%5B%221%22%5D%2C%22slot_name%22%3A%22mid_content_1%22%7D\" frameborder=\"0\" layout=\"responsive\" resizable=\"\" data-block-on-consent=\"_till_accepted\"><\/p>\n<p>View more<\/p>\n<p><\/amp-iframe><\/figure>\n<p>The bug means visiting a booby-trapped website could give cybercriminals control over your browser\u2014or any app that uses WebKit to render and display HTML content, says Paul Ducklin, a security researcher at cybersecurity firm <a href=\"https:\/\/nakedsecurity.sophos.com\/2023\/04\/08\/apple-issues-emergency-patches-for-spyware-style-0-day-exploits-update-now\/\" data-vars-link-click-url=\"https:\/\/nakedsecurity.sophos.com\/2023\/04\/08\/apple-issues-emergency-patches-for-spyware-style-0-day-exploits-update-now\/\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/nakedsecurity.sophos.com\/2023\/04\/08\/apple-issues-emergency-patches-for-spyware-style-0-day-exploits-update-now\/\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">Sophos<\/a>.<\/p>\n<p>The two flaws fixed in iOS 16.4.1 were reported by Google\u2019s Threat Analysis Group and Amnesty International\u2019s Security Lab. Taking this into account, Ducklin thinks the security holes could have been used for implanting spyware.<\/p>\n<p>Apple also released <a href=\"https:\/\/support.apple.com\/en-us\/HT213723\" data-vars-link-click-url=\"https:\/\/support.apple.com\/en-us\/HT213723\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/support.apple.com\/en-us\/HT213723\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">iOS 15.7.5<\/a> for users of older iPhones to fix the same already exploited flaws. Meanwhile, the iPhone maker issued macOS Ventura 13.3.1, Safari 16.4.1, macOS Monterey 12.6.5, and macOS Big Sur 11.7.6.<\/p>\n<h3>Microsoft<\/h3>\n<p>Apple wasn\u2019t the only big tech firm issuing emergency patches in April. Microsoft also released an urgent fix as part of this month\u2019s Patch Tuesday update. <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28252\" data-vars-link-click-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28252\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-28252\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-28252<\/a> is an elevation-of-privilege bug in the Windows Common Log File System Driver. An attacker who successfully exploited the flaw could gain system privileges, Microsoft said in an <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-28252\" data-vars-link-click-url=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-28252\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-28252\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">advisory.<\/a><\/p>\n<p>Another notable flaw, CVE-2023-21554, is a remote code execution vulnerability in Microsoft Message Queuing labeled as having a critical impact. To exploit the vulnerability, an attacker would need to send a malicious MSMQ packet to an MSMQ server, Microsoft said, which could result in remote code execution on the server side.<\/p>\n<figure class=\"ad ad-ratio ad-ratio-size-300x250\"><amp-ad width=\"320\" height=\"250\" type=\"doubleclick\" class=\"multi-size \" data-lazy-fetch=\"true\" data-loading-strategy=\"prefer-viewability-over-views\" data-slot=\"\/3379\/conde.wired\/mid-content\/security\/amp\/1\" data-multi-size=\"300x50,320x50,16x9,3x1,300x250\" data-multi-size-validation=\"false\" json=\"{&quot;targeting&quot;:{&quot;cnt_copilotid&quot;:[&quot;644c70820124a91cee27d77a&quot;],&quot;cnt_platform&quot;:[&quot;amp&quot;],&quot;cnt_tags&quot;:[&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;security&quot;,&quot;vulnerabilities&quot;,&quot;operating-systems&quot;,&quot;apple&quot;,&quot;microsoft&quot;,&quot;android&quot;,&quot;chrome&quot;,&quot;firefox&quot;,&quot;oracle&quot;,&quot;cisco&quot;,&quot;cyberattacks-and-hacks&quot;,&quot;article-settings&quot;,&quot;ContentHeader&quot;,&quot;variation&quot;,&quot;TextAboveLeftSmall&quot;,&quot;operating systems&quot;,&quot;Microsoft&quot;,&quot;Android&quot;,&quot;Chrome&quot;,&quot;Firefox&quot;,&quot;Oracle&quot;,&quot;Cisco&quot;],&quot;ctx_page_channel&quot;:[&quot;security&quot;],&quot;ctx_page_slug&quot;:&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;ctx_template&quot;:&quot;amp-article&quot;,&quot;partner&quot;:[&quot;amp&quot;],&quot;pos&quot;:[&quot;mid-content&quot;],&quot;pos_instance&quot;:[&quot;1&quot;],&quot;slot_name&quot;:&quot;mid_content_1&quot;}}\" rtc-config=\"{&quot;vendors&quot;:{&quot;aps&quot;:{&quot;PUB_ID&quot;:&quot;3035&quot;,&quot;PARAMS&quot;:{&quot;amp&quot;:&quot;1&quot;}},&quot;indexexchange&quot;:{&quot;SITE_ID&quot;:&quot;383288&quot;}},&quot;ias&quot;:&quot;https:\/\/pixel.adsafeprotected.com\/services\/pub\/amp&quot;,&quot;ias_id&quot;:931565,&quot;timeoutMillis&quot;:1000,&quot;urls&quot;:[&quot;https:\/\/segment-data.zqtk.net\/condenast-amp?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;,&quot;https:\/\/4d.condenastdigital.com\/amp\/content?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;]}\" data-block-on-consent=\"\"\/><\/figure>\n<p>The fix was part of a slew of patches for 98 vulnerabilities, so it\u2019s worth checking out the advisory and updating as soon as possible.<\/p>\n<h3>Google Android<\/h3>\n<p>Google has issued multiple patches for its Android operating system, fixing several serious holes. The most severe bug is a critical security vulnerability in the system component that could lead to remote code execution with no additional execution privileges needed, Google said in its <a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2023-04-01\" data-vars-link-click-url=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2023-04-01\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2023-04-01\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">Android Security Bulletin<\/a>. User interaction is not needed for exploitation.<\/p>\n<p>The patched issues include 10 in the framework, including eight elevation-of-privilege flaws, and nine others rated as having a high severity. Google fixed 16 bugs in the system including two critical RCE flaws and several issues in the kernel and SoC components.<\/p>\n<p>The update also includes several <a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/pixel\/2023-04-01\" data-vars-link-click-url=\"https:\/\/source.android.com\/docs\/security\/bulletin\/pixel\/2023-04-01\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/source.android.com\/docs\/security\/bulletin\/pixel\/2023-04-01\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">Pixel-specific<\/a> patches, including an elevation-of-privilege flaw in the kernel tracked as CVE-2023-0266. The Android April patch is available for Google\u2019s devices as well as models <a href=\"https:\/\/9to5google.com\/2023\/04\/26\/samsung-galaxy-april-2023-update\/\" data-vars-link-click-url=\"https:\/\/9to5google.com\/2023\/04\/26\/samsung-galaxy-april-2023-update\/\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/9to5google.com\/2023\/04\/26\/samsung-galaxy-april-2023-update\/\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">including<\/a> Samsung\u2019s Galaxy S-series alongside the Fold and Flip-series.<\/p>\n<h3>Google Chrome<\/h3>\n<p>At the start of April, Google issued a <a href=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop.html\" data-vars-link-click-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop.html\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop.html\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">patch<\/a> to fix 16 issues in its popular Chrome browser, some of which are serious. The patched flaws include CVE-2023-1810, a heap buffer overflow issue in Visuals rated as having a high impact, and CVE-2023-1811, a use-after-free vulnerability in Frames. The remaining 14 security bugs are rated as having a medium or low impact.<\/p>\n<figure class=\"ad ad-ratio ad-ratio-size-300x250\"><amp-ad width=\"320\" height=\"250\" type=\"doubleclick\" class=\"multi-size \" data-lazy-fetch=\"true\" data-loading-strategy=\"prefer-viewability-over-views\" data-slot=\"\/3379\/conde.wired\/mid-content\/security\/amp\/2\" data-multi-size=\"300x50,320x50,16x9,3x1,300x250\" data-multi-size-validation=\"false\" json=\"{&quot;targeting&quot;:{&quot;cnt_copilotid&quot;:[&quot;644c70820124a91cee27d77a&quot;],&quot;cnt_platform&quot;:[&quot;amp&quot;],&quot;cnt_tags&quot;:[&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;security&quot;,&quot;vulnerabilities&quot;,&quot;operating-systems&quot;,&quot;apple&quot;,&quot;microsoft&quot;,&quot;android&quot;,&quot;chrome&quot;,&quot;firefox&quot;,&quot;oracle&quot;,&quot;cisco&quot;,&quot;cyberattacks-and-hacks&quot;,&quot;article-settings&quot;,&quot;ContentHeader&quot;,&quot;variation&quot;,&quot;TextAboveLeftSmall&quot;,&quot;operating systems&quot;,&quot;Microsoft&quot;,&quot;Android&quot;,&quot;Chrome&quot;,&quot;Firefox&quot;,&quot;Oracle&quot;,&quot;Cisco&quot;],&quot;ctx_page_channel&quot;:[&quot;security&quot;],&quot;ctx_page_slug&quot;:&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;ctx_template&quot;:&quot;amp-article&quot;,&quot;partner&quot;:[&quot;amp&quot;],&quot;pos&quot;:[&quot;mid-content&quot;],&quot;pos_instance&quot;:[&quot;2&quot;],&quot;slot_name&quot;:&quot;mid_content_2&quot;}}\" rtc-config=\"{&quot;vendors&quot;:{&quot;aps&quot;:{&quot;PUB_ID&quot;:&quot;3035&quot;,&quot;PARAMS&quot;:{&quot;amp&quot;:&quot;1&quot;}},&quot;indexexchange&quot;:{&quot;SITE_ID&quot;:&quot;383288&quot;}},&quot;ias&quot;:&quot;https:\/\/pixel.adsafeprotected.com\/services\/pub\/amp&quot;,&quot;ias_id&quot;:931565,&quot;timeoutMillis&quot;:1000,&quot;urls&quot;:[&quot;https:\/\/segment-data.zqtk.net\/condenast-amp?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;,&quot;https:\/\/4d.condenastdigital.com\/amp\/content?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;]}\" data-block-on-consent=\"\"\/><\/figure>\n<p>Mid-month, Google was forced to issue an emergency update, this time to fix two flaws, one of which is already being used in real-life attacks. <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-2033\" data-vars-link-click-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-2033\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-2033\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-2033<\/a> is a type of confusion flaw in the V8 JavaScript engine. \u201cGoogle is aware that an exploit for CVE-2023-2033 exists in the wild,\u201d the software giant said on its <a href=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_14.html\" data-vars-link-click-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_14.html\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_14.html\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">blog<\/a>.<\/p>\n<p>Just days later, Google <a href=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_18.html?m=1\" data-vars-link-click-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_18.html?m=1\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/chromereleases.googleblog.com\/2023\/04\/stable-channel-update-for-desktop_18.html?m=1\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">released<\/a> another patch, fixing issues including another zero-day flaw tracked as CVE-2023-2136, an integer overflow bug in the Skia graphics engine.<\/p>\n<p>Given the number and seriousness of the issues, Chrome users should prioritize checking that their current version is up to date.<\/p>\n<h3>Mozilla Firefox<\/h3>\n<p>Chrome rival Firefox has fixed issues in Firefox 112, Firefox for Android 112, and Focus for Android 112. Among the flaws is CVE-2023-29531, an out-of-bound memory access in WebGL on macOS rated as having a high impact. Meanwhile, CVE-2023-29532 is a bypass flaw affecting Windows, which requires local system access.<\/p>\n<p>CVE-2023-1999 is a double-free in libwebp that could result in memory corruption and a potentially exploitable crash, Firefox owner Mozilla wrote in an <a href=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-13\/\" data-vars-link-click-url=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-13\/\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-13\/\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">advisory<\/a>.<\/p>\n<p>Mozilla also fixed two memory safety bugs, CVE-2023-29550 and CVE-2023-29551. \u201cSome of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code,\u201d the browser maker said.<\/p>\n<figure class=\"ad ad-ratio ad-ratio-size-300x250\"><amp-ad width=\"320\" height=\"250\" type=\"doubleclick\" class=\"multi-size \" data-lazy-fetch=\"true\" data-loading-strategy=\"prefer-viewability-over-views\" data-slot=\"\/3379\/conde.wired\/mid-content\/security\/amp\/3\" data-multi-size=\"300x50,320x50,16x9,3x1,300x250\" data-multi-size-validation=\"false\" json=\"{&quot;targeting&quot;:{&quot;cnt_copilotid&quot;:[&quot;644c70820124a91cee27d77a&quot;],&quot;cnt_platform&quot;:[&quot;amp&quot;],&quot;cnt_tags&quot;:[&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;security&quot;,&quot;vulnerabilities&quot;,&quot;operating-systems&quot;,&quot;apple&quot;,&quot;microsoft&quot;,&quot;android&quot;,&quot;chrome&quot;,&quot;firefox&quot;,&quot;oracle&quot;,&quot;cisco&quot;,&quot;cyberattacks-and-hacks&quot;,&quot;article-settings&quot;,&quot;ContentHeader&quot;,&quot;variation&quot;,&quot;TextAboveLeftSmall&quot;,&quot;operating systems&quot;,&quot;Microsoft&quot;,&quot;Android&quot;,&quot;Chrome&quot;,&quot;Firefox&quot;,&quot;Oracle&quot;,&quot;Cisco&quot;],&quot;ctx_page_channel&quot;:[&quot;security&quot;],&quot;ctx_page_slug&quot;:&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;ctx_template&quot;:&quot;amp-article&quot;,&quot;partner&quot;:[&quot;amp&quot;],&quot;pos&quot;:[&quot;mid-content&quot;],&quot;pos_instance&quot;:[&quot;3&quot;],&quot;slot_name&quot;:&quot;mid_content_3&quot;},&quot;useSameDomainRenderingUntilDeprecated&quot;:1}\" rtc-config=\"{&quot;vendors&quot;:{&quot;aps&quot;:{&quot;PUB_ID&quot;:&quot;3035&quot;,&quot;PARAMS&quot;:{&quot;amp&quot;:&quot;1&quot;}},&quot;indexexchange&quot;:{&quot;SITE_ID&quot;:&quot;383288&quot;}},&quot;ias&quot;:&quot;https:\/\/pixel.adsafeprotected.com\/services\/pub\/amp&quot;,&quot;ias_id&quot;:931565,&quot;timeoutMillis&quot;:1000,&quot;urls&quot;:[&quot;https:\/\/segment-data.zqtk.net\/condenast-amp?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;,&quot;https:\/\/4d.condenastdigital.com\/amp\/content?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;]}\" data-block-on-consent=\"\"\/><\/figure>\n<h3>SolarWinds<\/h3>\n<p>IT giant <a href=\"https:\/\/www.wired.com\/story\/russia-solarwinds-hack-targets-fallout\/#intcid=inline_amp\" data-vars-link-click-url=\"https:\/\/www.wired.com\/story\/russia-solarwinds-hack-targets-fallout\/#intcid=inline_amp\" data-vars-link-type=\"Internal\">SolarWinds<\/a> has patched two high-severity issues in its platform that could lead to command execution and privilege escalation. Tracked as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-36963\" data-vars-link-click-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-36963\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-36963\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2022-36963<\/a>, the first issue is a command-injection flaw in SolarWinds\u2019 infrastructure monitoring and management product, the firm wrote in a <a href=\"https:\/\/www.solarwinds.com\/trust-center\/security-advisories\" data-vars-link-click-url=\"https:\/\/www.solarwinds.com\/trust-center\/security-advisories\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.solarwinds.com\/trust-center\/security-advisories\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">security advisory<\/a>. If exploited, the bug could allow a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands.<\/p>\n<p>Another high-severity issue is CVE-2022-47505, a local privilege escalation vulnerability that a local adversary with a valid system user account could use to escalate privileges.<\/p>\n<p>The latest SolarWinds patch fixes several more issues rated as having a medium impact. None have been used in attacks, but if you are impacted by the flaws, it makes sense to update as soon as possible.<\/p>\n<h3>Oracle<\/h3>\n<p>April has been a big month for enterprise software maker Oracle, which has issued fixes for 433 vulnerabilities, 70 of which are rated as having a critical severity. These include issues in the Oracle GoldenGate Risk Matrix, including CVE-2022-23457, which has a CVSS base score of 9.8. The issue may be remotely exploitable without authentication, Oracle said in its <a href=\"https:\/\/www.oracle.com\/security-alerts\/cpuapr2023.html\" data-vars-link-click-url=\"https:\/\/www.oracle.com\/security-alerts\/cpuapr2023.html\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.oracle.com\/security-alerts\/cpuapr2023.html\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">advisory<\/a>.<\/p>\n<p>The April fixes also contain six new patches for Oracle Commerce. \u201cAll of these vulnerabilities may be remotely exploitable without authentication,\u201d Oracle warned.<\/p>\n<figure class=\"ad ad-ratio ad-ratio-size-300x250\"><amp-ad width=\"320\" height=\"250\" type=\"doubleclick\" class=\"multi-size \" data-lazy-fetch=\"true\" data-loading-strategy=\"prefer-viewability-over-views\" data-slot=\"\/3379\/conde.wired\/mid-content\/security\/amp\/4\" data-multi-size=\"300x50,320x50,16x9,3x1,300x250\" data-multi-size-validation=\"false\" json=\"{&quot;targeting&quot;:{&quot;cnt_copilotid&quot;:[&quot;644c70820124a91cee27d77a&quot;],&quot;cnt_platform&quot;:[&quot;amp&quot;],&quot;cnt_tags&quot;:[&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;security&quot;,&quot;vulnerabilities&quot;,&quot;operating-systems&quot;,&quot;apple&quot;,&quot;microsoft&quot;,&quot;android&quot;,&quot;chrome&quot;,&quot;firefox&quot;,&quot;oracle&quot;,&quot;cisco&quot;,&quot;cyberattacks-and-hacks&quot;,&quot;article-settings&quot;,&quot;ContentHeader&quot;,&quot;variation&quot;,&quot;TextAboveLeftSmall&quot;,&quot;operating systems&quot;,&quot;Microsoft&quot;,&quot;Android&quot;,&quot;Chrome&quot;,&quot;Firefox&quot;,&quot;Oracle&quot;,&quot;Cisco&quot;],&quot;ctx_page_channel&quot;:[&quot;security&quot;],&quot;ctx_page_slug&quot;:&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;ctx_template&quot;:&quot;amp-article&quot;,&quot;partner&quot;:[&quot;amp&quot;],&quot;pos&quot;:[&quot;mid-content&quot;],&quot;pos_instance&quot;:[&quot;4&quot;],&quot;slot_name&quot;:&quot;mid_content_4&quot;}}\" rtc-config=\"{&quot;vendors&quot;:{&quot;aps&quot;:{&quot;PUB_ID&quot;:&quot;3035&quot;,&quot;PARAMS&quot;:{&quot;amp&quot;:&quot;1&quot;}},&quot;indexexchange&quot;:{&quot;SITE_ID&quot;:&quot;383288&quot;}},&quot;ias&quot;:&quot;https:\/\/pixel.adsafeprotected.com\/services\/pub\/amp&quot;,&quot;ias_id&quot;:931565,&quot;timeoutMillis&quot;:1000,&quot;urls&quot;:[&quot;https:\/\/segment-data.zqtk.net\/condenast-amp?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;,&quot;https:\/\/4d.condenastdigital.com\/amp\/content?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;]}\" data-block-on-consent=\"\"\/><\/figure>\n<p>Due to the threat posed by a successful attack, Oracle \u201cstrongly recommends\u201d that customers apply Critical Patch Update security fixes as soon as possible.<\/p>\n<h3>Cisco<\/h3>\n<p>Software firm Cisco has <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-adeos-MLAyEcvk\" data-vars-link-click-url=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-adeos-MLAyEcvk\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-adeos-MLAyEcvk\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">released<\/a> fixes for vulnerabilities that could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system.<\/p>\n<p>CVE-2023-20121, which affects Cisco EPNM, Cisco ISE, and Cisco Prime Infrastructure, is a\u00a0 command-injection vulnerability. An attacker could exploit the flaw by logging in to the device and issuing a crafted CLI command. \u201cA successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device,\u201d Cisco said, adding that the attacker must be an authenticated shell user to exploit the flaw.<\/p>\n<p>Meanwhile, CVE-2023-20122 is a command-injection vulnerability in the restricted shell of Cisco ISE that could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system.<\/p>\n<h3>SAP<\/h3>\n<p>It\u2019s been another busy <a href=\"https:\/\/dam.sap.com\/mac\/app\/e\/pdf\/preview\/embed\/ucQrx6G?ltr=a&amp;rc=10\" data-vars-link-click-url=\"https:\/\/dam.sap.com\/mac\/app\/e\/pdf\/preview\/embed\/ucQrx6G?ltr=a&amp;rc=10\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/dam.sap.com\/mac\/app\/e\/pdf\/preview\/embed\/ucQrx6G?ltr=a&amp;rc=10\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">Patch Day<\/a> for SAP, which saw the release of 19 new Security Notes. Among the fixes are <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-27497\" data-vars-link-click-url=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-27497\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-27497\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-27497<\/a>, comprising multiple vulnerabilities in SAP Diagnostics Agent. Another notable patch is <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-28765\" data-vars-link-click-url=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-28765\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-28765\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2023-28765<\/a>, an information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform. A missing password protection enforcement allows an attacker to access the lcmbiar file, according to security firm <a href=\"https:\/\/onapsis.com\/blog\/sap-patch-day-april-2023\" data-vars-link-click-url=\"https:\/\/onapsis.com\/blog\/sap-patch-day-april-2023\" data-vars-link-type=\"External\" data-vars-offer-url=\"https:\/\/onapsis.com\/blog\/sap-patch-day-april-2023\" class=\"data-offer-external-url\" rel=\"nofollow noopener\" target=\"_blank\">Onapsis<\/a>. \u201cAfter successful decryption of its content, the attacker could gain access to a user\u2019s passwords,\u201d the firm explained. \u201cDepending on the authorizations of the impersonated user, an attacker could completely compromise the system\u2019s confidentiality, integrity, and availability.\u201d<\/p>\n<figure class=\"ad ad-ratio ad-ratio-size-300x250\"><amp-ad width=\"320\" height=\"250\" type=\"doubleclick\" class=\"multi-size \" data-lazy-fetch=\"true\" data-loading-strategy=\"prefer-viewability-over-views\" data-slot=\"\/3379\/conde.wired\/mid-content\/security\/amp\/5\" data-multi-size=\"300x50,320x50,16x9,3x1,300x250\" data-multi-size-validation=\"false\" json=\"{&quot;targeting&quot;:{&quot;cnt_copilotid&quot;:[&quot;644c70820124a91cee27d77a&quot;],&quot;cnt_platform&quot;:[&quot;amp&quot;],&quot;cnt_tags&quot;:[&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;security&quot;,&quot;vulnerabilities&quot;,&quot;operating-systems&quot;,&quot;apple&quot;,&quot;microsoft&quot;,&quot;android&quot;,&quot;chrome&quot;,&quot;firefox&quot;,&quot;oracle&quot;,&quot;cisco&quot;,&quot;cyberattacks-and-hacks&quot;,&quot;article-settings&quot;,&quot;ContentHeader&quot;,&quot;variation&quot;,&quot;TextAboveLeftSmall&quot;,&quot;operating systems&quot;,&quot;Microsoft&quot;,&quot;Android&quot;,&quot;Chrome&quot;,&quot;Firefox&quot;,&quot;Oracle&quot;,&quot;Cisco&quot;],&quot;ctx_page_channel&quot;:[&quot;security&quot;],&quot;ctx_page_slug&quot;:&quot;apple-google-microsoft-zero-day-critical-update-april&quot;,&quot;ctx_template&quot;:&quot;amp-article&quot;,&quot;partner&quot;:[&quot;amp&quot;],&quot;pos&quot;:[&quot;mid-content&quot;],&quot;pos_instance&quot;:[&quot;5&quot;],&quot;slot_name&quot;:&quot;mid_content_5&quot;}}\" rtc-config=\"{&quot;vendors&quot;:{&quot;aps&quot;:{&quot;PUB_ID&quot;:&quot;3035&quot;,&quot;PARAMS&quot;:{&quot;amp&quot;:&quot;1&quot;}},&quot;indexexchange&quot;:{&quot;SITE_ID&quot;:&quot;383288&quot;}},&quot;ias&quot;:&quot;https:\/\/pixel.adsafeprotected.com\/services\/pub\/amp&quot;,&quot;ias_id&quot;:931565,&quot;timeoutMillis&quot;:1000,&quot;urls&quot;:[&quot;https:\/\/segment-data.zqtk.net\/condenast-amp?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;,&quot;https:\/\/4d.condenastdigital.com\/amp\/content?url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fapple-google-microsoft-zero-day-critical-update-april%2F&quot;]}\" data-block-on-consent=\"\"\/><\/figure>\n<\/div>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"7859258044\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<br \/><a href=\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp\">READ SOURCE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tech giants Apple, Microsoft, and Google each fixed major security flaws in April, many of which were already being used in real-life attacks. Other firms to issue patches include privacy-focused browser Firefox and enterprise software providers SolarWinds and Oracle. Here\u2019s everything you need to know about the patches released in April. Apple Hot on the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1221282,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_oct_exclude_from_cache":false,"footnotes":""},"categories":[53],"tags":[],"class_list":["post-1221281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph\" \/>\n<meta property=\"og:description\" content=\"Tech giants Apple, Microsoft, and Google each fixed major security flaws in April, many of which were already being used in real-life attacks. Other firms to issue patches include privacy-focused browser Firefox and enterprise software providers SolarWinds and Oracle. Here\u2019s everything you need to know about the patches released in April. Apple Hot on the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp\" \/>\n<meta property=\"og:site_name\" content=\"Business Telegraph\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-30T11:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2401\" \/>\n\t<meta property=\"og:image:height\" content=\"1351\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"businesstelegraph\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"businesstelegraph\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/\"},\"author\":{\"name\":\"businesstelegraph\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\"},\"headline\":\"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws &#8211; WIRED\",\"datePublished\":\"2023-04-30T11:00:00+00:00\",\"dateModified\":\"2023-04-30T11:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/\"},\"wordCount\":1302,\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg\",\"articleSection\":[\"security\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/\",\"url\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp\",\"name\":\"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg\",\"datePublished\":\"2023-04-30T11:00:00+00:00\",\"dateModified\":\"2023-04-30T11:00:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg\",\"contentUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg\",\"width\":2401,\"height\":1351},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.businesstelegraph.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws &#8211; WIRED\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"name\":\"Business Telegraph UK\",\"description\":\"business, tech and industry news\",\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\",\"name\":\"Business Telegraph UK\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"contentUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"width\":500,\"height\":177,\"caption\":\"Business Telegraph UK\"},\"image\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\",\"name\":\"businesstelegraph\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp","og_locale":"en_GB","og_type":"article","og_title":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph","og_description":"Tech giants Apple, Microsoft, and Google each fixed major security flaws in April, many of which were already being used in real-life attacks. Other firms to issue patches include privacy-focused browser Firefox and enterprise software providers SolarWinds and Oracle. Here\u2019s everything you need to know about the patches released in April. Apple Hot on the [&hellip;]","og_url":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp","og_site_name":"Business Telegraph","article_published_time":"2023-04-30T11:00:00+00:00","og_image":[{"width":2401,"height":1351,"url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg","type":"image\/jpeg"}],"author":"businesstelegraph","twitter_card":"summary_large_image","twitter_misc":{"Written by":"businesstelegraph","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#article","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/"},"author":{"name":"businesstelegraph","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78"},"headline":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws &#8211; WIRED","datePublished":"2023-04-30T11:00:00+00:00","dateModified":"2023-04-30T11:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/"},"wordCount":1302,"publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"image":{"@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage"},"thumbnailUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg","articleSection":["security"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.businesstelegraph.co.uk\/apple-google-and-microsoft-just-fixed-zero-day-security-flaws-wired\/","url":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp","name":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws - WIRED - Business Telegraph","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage"},"image":{"@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage"},"thumbnailUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg","datePublished":"2023-04-30T11:00:00+00:00","dateModified":"2023-04-30T11:00:00+00:00","breadcrumb":{"@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#primaryimage","url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg","contentUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2023\/04\/Apple-Google-and-Microsoft-Just-Fixed-Zero-Day-Security-Flaws.jpg","width":2401,"height":1351},{"@type":"BreadcrumbList","@id":"https:\/\/www.wired.com\/story\/apple-google-microsoft-zero-day-critical-update-april\/amp#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.businesstelegraph.co.uk\/"},{"@type":"ListItem","position":2,"name":"Apple, Google, and Microsoft Just Fixed Zero-Day Security Flaws &#8211; WIRED"}]},{"@type":"WebSite","@id":"https:\/\/www.businesstelegraph.co.uk\/#website","url":"https:\/\/www.businesstelegraph.co.uk\/","name":"Business Telegraph UK","description":"business, tech and industry news","publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.businesstelegraph.co.uk\/#organization","name":"Business Telegraph UK","url":"https:\/\/www.businesstelegraph.co.uk\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/","url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","contentUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","width":500,"height":177,"caption":"Business Telegraph UK"},"image":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78","name":"businesstelegraph","url":"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/"}]}},"_links":{"self":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1221281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/comments?post=1221281"}],"version-history":[{"count":0,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1221281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/media\/1221282"}],"wp:attachment":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/media?parent=1221281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/categories?post=1221281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/tags?post=1221281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}