Friday security advisories often land late, here is what to patch before the weekend
Marcus Webb ·
Governments and vendors frequently publish security advisories late on Fridays, which can leave internet‑facing systems exposed over the weekend. Security teams heading offline today should prioritize three actively targeted issues with available fixes, CVE-2024-6387 in OpenSSH, CVE-2024-3400 in Palo Alto Networks PAN‑OS GlobalProtect, and CVE-2024-4577 in PHP CGI.
This matters because all three enable remote compromise paths and have public exploit code or observed exploitation. TechGlobal.news cannot independently verify any brand new Friday releases at press time, but these remain among the highest risk if still unpatched.
Immediate priorities
OpenSSH regreSSHion, CVE-2024-6387, is a signal handler race in sshd on many glibc-based Linux systems. It enables unauthenticated remote code execution under specific timing, and researchers and botnets have probed it at scale. Update to OpenSSH 9.8p1 or apply distribution backports, and limit exposure by restricting SSH from the internet where possible.
Palo Alto Networks PAN‑OS GlobalProtect command injection, CVE-2024-3400, was exploited in April 2024 by UTA0218, a suspected state-aligned actor, for device takeover. It affects specific PAN‑OS 10.2, 11.0, and 11.1 releases when GlobalProtect is enabled. Apply hotfixes 10.2.9‑h1, 11.0.4‑h1, or 11.1.2‑h3, and ensure the Threat Prevention content update with signature 95187 or newer is installed, then search for indicators of compromise on appliances.
PHP CGI argument injection on Windows, CVE-2024-4577, allows remote code execution in CGI deployments, including common developer stacks such as XAMPP. Attackers have used it to drop web shells. Upgrade to PHP 8.3.8, 8.2.20, or 8.1.29, or disable CGI mode entirely, and add web server rules to block direct invocation of php-cgi where removal is not possible.
Expect late Friday drops
Teams should also monitor vendor portals and mailing lists that historically post late on Fridays, including Atlassian advisories, Apple Rapid Security Responses, cloud provider security bulletins, and CISA Known Exploited Vulnerabilities catalog updates. If a late advisory lands, triage for internet exposure, known exploitation, and availability of a stable patch, then apply compensating controls until maintenance windows open.
The recurring Friday disclosure pattern underscores the need for fast rollback-capable patch pipelines, strict exposure management for admin interfaces, and segmentation controls that contain weekend compromises before they escalate.