Suriyapong Thongsawang

• The West Texas Intermediate (WTI) crude ended last week’s rally up by 5.46%. 
• Saudi Arabian stocks climbed on Sunday, the Tadawul All Share Index (TASI), inching 0.2% higher. 
• The global supply of these commodities is expected to remain tight.

The West Texas Intermediate (WTI) crude, a main benchmark for oil prices, ended last week’s rally up by 5.46%. 

In response, Saudi Arabian stocks climbed on Sunday, with the Tadawul All Share Index (TASI), inching 0.2% higher. 

The upticks come amid fears over tightening oil supply. On Friday, Russia’s Deputy Prime Minister Alexander Novak told state television that the country could reduce oil output by 5 to 7% in early 2023.

The decision comes in response to The Group of Seven (G7)’s price cap on Russian exports made earlier this month. Exported barrels must remain below $60 if it is to be shipped by G7 and EU tankers, insurance companies, and credit institutions, Reuters reported. The move by the group, comprised of European Union countries and Australia, aims to limit seaborne oil exports to restrict Russia’s capacity to finance its war in Ukraine. 

This year, the energy sector has seen a strong performance relative to the broad stock market. 

The Russian invasion of Ukraine in February sent oil and gas into scarcity. 

The global supply of these commodities is expected to remain tight. Aside from the conflict, companies within the sector aren’t spending enough on capital expenditure. 

While it may be bad news for energy prices, it could also mean investors have a continued safe haven leading into the new year. 

Even after energy stocks had a strong run in 2022, there could be more upside as demand is expected to outpace supply, a fund manager who oversees an energy sector fund, the Integrity Mid-North American Resources Fund (ICPAX), told Insider.

Busloads of migrants were dropped over Christmas weekend near Vice President Kamala Harris’ residence in Washington amid freezing temperatures, having traveled from the southwest border in Texas, immigrant aid groups said on Sunday.

Approximately 110-130 of the migrants seeking asylum in the United States, many of them families with children, were placed on buses by Texas officials, said Tatiana Laborde, managing director of SAMU First Response, a relief agency working with the city of Washington, D.C.

She said by phone that aid groups had been informed of their journey and awaited their arrival late on Saturday to hand out blankets and then transport them to a church in the city’s Capitol Hill neighborhood.

Aides to Texas Governor Greg Abbott were not available to comment on whether the state coordinated their transportation.

The Republican governor, a vocal critic of the Biden administration’s immigration policies, and some other Republican governors have been transporting migrants to Democratic-controlled cities in the northern United States. read more

Texas has bused thousands of migrants to Washington, New York City and Chicago, in what some critics have labeled a stunt amid a national debate over the high levels of immigrant arrivals along the U.S. southern border.

Laborde said that in the past week, nine busloads of migrants have been dropped off in Washington.

“Lately, what we’ve been seeing is an increase in people from Ecuador and Colombia,” Laborde said. Previously, many Venezuelans had been arriving by bus, she added.

Many of the most recent arrivals, Laborde said, are now attempting to go to New York or New Jersey where they have relatives or other community support.

(Reuters) – Thousands of residents were without power near Tacoma, Washington, after two electrical substations were attacked, and the incidents have been reported to the police, the local utility company said on Sunday.

“Early this morning, two Tacoma Power substation facilities were attacked in east Pierce county. … Law enforcement has been notified,” Tacoma Public Utilities said in a post on Twitter. The utility gave no other details about the nature of the Christmas Day attack.

About 2,700 people serviced by Tacoma Public Utilities were affected after an initial 7,300 residents lost power in east Pierce County, about 45 miles (72 km) south of Seattle, the company said. “We are working as quickly and safely as possible to restore power,” it said.

Earlier this month, a utility in North Carolina reported outages from what local authorities said were orchestrated shootings now being investigated by federal law enforcement.

The FBI has also been investigating shots fired near a power facility in South Carolina days later, and whether those two incidents could be related, NBC News and other local media have reported.

Utilities nationwide have been strained by a severe cold weather system that swept across the country this week, leaving more than 300,000 without power from the winter storm.

A deadly blizzard pummeled Buffalo, New York, on Christmas Day, trapping people in their cars, causing power outages and raising the death toll from a severe winter storm system that has swept the United States.

Thirty people have died so far in weather-related incidents across the country, according to an NBC News tally. CNN reported a total of 26 deaths.

Erie County Executive Mark Poloncarz said the death toll from the storm had risen to seven from three overnight in the Buffalo region in far western New York. Some of the four reported dead on Sunday morning were found in cars and some in snow banks, Poloncarz said, adding that the death count might still rise.

“This is not the Christmas any of us hoped for nor expected,” Poloncarz said on Twitter on Sunday. “My deepest condolences to the families who have lost loved ones.

Christina Klaffka, a 39-year-old North Buffalo resident, watched the shingles blow off her neighbor’s home and listened to her windows rattle from “hurricane-like winds.” She lost power along with her whole neighborhood on Saturday evening, and was still without electricity on Sunday morning.

“My TV kept flickering while I was trying to watch the Buffalo Bills and Chicago Bears game. I lost power shortly after the 3rd quarter,” she said.

Cars were trapped under 5-foot snow drifts in her neighborhood, Klaffka said, with more snow still forecast for Sunday afternoon.

New York Governor Kathy Hochul told reporters on Sunday that the Biden administration had agreed to support her request for a federal disaster declaration. Some 200 National Guard troops were on the ground in western New York, providing relief to first responders, doing wellness checks and bringing supplies to shelters, and more were on the way, Hochul said.

Two days of white-out conditions in western New York had made rescue efforts nearly impossible at times, officials said.

The blizzard was a result of a powerful winter weather system that has caused frigid temperatures from the Northern Great Plains to the U.S.-Mexico border since mid-last week. The storm was moving east on Sunday, after knocking out power to millions late last week and causing flight cancellations during the busy holiday travel period.

More than 150,000 U.S. homes and businesses were without power on Sunday, a sharp drop from the 1.8 million that were powerless as of early Saturday, according to PowerOutage.us. In Buffalo, 16% of residents had no electricity on Sunday, officials said.

More than 1,700 flights in the United States were canceled as of midday Sunday, according to flight tracker FlightAware, as weather further snarled holiday travel.

Christmas Day temperatures were still well below average across the central and eastern U.S., and below freezing even as far south as the Gulf Coast, National Weather Service (NWS) meteorologist Rich Otto said.

In Erie County, hundreds of motorists were stranded in their vehicles over the weekend, with the National Guard called in to help with rescues, Poloncarz said.

A countywide driving ban remained in effect on Sunday.

The Buffalo airport had recorded nearly four feet of snow by Sunday morning, the National Weather Service said. White-out conditions persisted south of Buffalo on Sunday afternoon, with snow falling 2-3 inches per hour.

Officials in Kentucky confirmed there were at least three storm-related deaths in that state, while at least four people were dead and several injured in auto-related accidents in Ohio, where a 50-vehicle pileup shut down the Ohio Turnpike in both directions during a blizzard near Toledo on Friday.

Other deaths related to the extreme cold or weather-induced vehicle accidents were reported in Missouri, Tennessee, Kansas and Colorado, according to news reports.

Related Galleries:

Mikhail Svetlov/Getty Images

• Vladimir Putin claimed that Russia is ready for talks in a state television interview. 
• His claims came amid continued shelling of Ukrainian cities over the holiday weekend. 
• A leading think tank says Russian forces are growing weary in their offensive attacks. 

Russian President Vladimir Putin claimed he’s ready for talks that could end the war in Ukraine but blamed the other side for refusing to come to the table, The Associated Press reported on Sunday. 

In the statements, taken from a state television interview, Putin said that Russia is “prepared to negotiate some acceptable outcomes with all the participants of this process” but that “it’s not us who refuse talks, it’s them.” 

Putin further tried to justify Russia’s actions by stating that Moscow has no other choice and that the Kremlin was defending Russia’s national interests, the interests of its citizens, and people.

The Russian president has previously made comments about wanting to end the war. In September, he responded to criticism over the ongoing conflict by Indian Prime Minister Narendra Modi during an in-person meeting in Uzbekistan, Reuters reported. Putin said, “I know about your position on the conflict in Ukraine, and I know about your concerns. We want all of this to end as soon as possible.”

Sunday’s claims came on the heels of continued attacks on Ukraine from Moscow. 

On Christmas day, two country-wide air raid alerts sounded off. Local officials reported that three missiles hit the city of Kramatorsk in the partially occupied Donetsk region. Six rounds of shelling also hit the city of Avdiivka, according to Pavlo Kyrylenko, the governor of Donetsk Oblast.

On Saturday, at least 10 people were killed and 55 were injured after Russian shells hit the Ukrainian city of Kherson. 

Mykhailo Podolyak, an adviser to the head of the office of the president of Ukraine, tweeted on Sunday that Russia doesn’t want negotiations and is only trying to avoid responsibility. 

—Михайло Подоляк (@Podolyak_M) December 25, 2022

The Institute for the Study of War, a Washington think tank, suggested that Russian war efforts are weakening. 

On December 24, the ISW reported that the Russian forces’ rate of advance in the Bakhmut area, the eastern region of Ukraine, has slowed in recent days. 

On the same day, the UK Ministry of Defense noted that it’s highly likely that a shortage of munitions is the key limiting factor as forces struggle to maintain offensive operations in that region. 

The ISW suggested that the developments could lead Russian forces to initiate a tactical or operational pause. 

Over the holidays, Ukrainians took their fight for Independence into other avenues of their lives. In an effort to break from Russian traditions, some Orthodox Ukrainians celebrated Christmas on December 25, as opposed to January 7 in line with the Russian Orthodox Church.  The shift came after the Orthodox Church of Ukraine, one of two branches of Orthodox Christianity agreed to the adjustment, per AP.

Mario Duncanson/Getty Images

• Alameda Research borrowed billions of dollars of customer funds from FTX exchange. 
• The firm’s liabilities were then masked under a pseudonym account on FTX.
• Caroline Ellison and Gary Wang have pleaded guilty to numerous counts of fraud. 

The case of “where did the money go” is beginning to unravel for crypto exchange FTX.

On November 11, the exchange’s founder, Sam Bankman-Fried filed for Chapter 11 bankruptcy protection for FTX and about 130 of its affiliated companies. The decision came after a scurry of withdrawals left the exchange illiquid. 

On Wednesday, Bankman-Fried arrived on US soil after he was extradited from the Bahamas. On Friday the Associated Press reported that a US judge had kept secret that two of his former associates, Caroline Ellison, CEO of Alameda and Gary Wang, co-founder of FTX, pleaded guilty to fraud charges and were cooperating with the feds. Prosecutors feared Bankman-Fried would fight extradition if he knew his partners had turned on him. 

Alameda Research, a trading and investment fund started by Bankman-Fried, had borrowed billions of dollars from the exchange, losing it to a series of bad deals and trades. It was later revealed that that money came from customer deposits. 

A lawsuit filed by the Commodity Futures Trading Commission on December 13 states that Bankman-Fried directed FTX executives to move Alameda’s approximately $8 billion in liabilities to an unknown customer account on FTX’s systems. 

The lawsuit also claimed that Bankman-Fried would later refer to that account as “our Korean friend’s account” and/or “the weird Korean account.” It added that although it was a sub-account of Alameda, it did not have the typical investment firm’s email identifier “@alameda-research.com.” Notes tied to the account labeled it as “FTX fiat old.”

The suit claims that this helped mask Alameda’s negative balance on FTX. However, the account had the same privileges as those of Alameda accounts, including exemption from liquidation characteristics. 

A day later, on December 14, Bloomberg reported that a GitHub account under the name Nishad Singh, FTX’s former engineering director, created a code that would conceal Alameda’s ballooning liabilities on the exchange. 

The implosion of FTX sent shockwaves throughout the crypto community. A few months before its downfall, Bankman-Fried had assured investors that the worst of the crypto market’s liquidity crunch had likely passed. He added that he still had a “few billion” on hand to shore up struggling firms that could further destabilize the digital asset industry. 

On Thursday, Bankman-Fried walked out of a New York federal court after being released on a $250 million bail. 

On December 18, Ellison pleaded guilty to seven counts of federal fraud charges including conspiracy to commit wire fraud on FTX customers and money laundering. She could be facing up to 110 years in prison but has agreed to fully cooperate in exchange for a lesser sentence. 

Wang pleaded guilty to four counts of similar charges. He could face up to 50 years in prison and has also agreed to cooperate with the feds. 

The year 2020 began as a year of great possibilities for the embattled president. Early polls indicated he was not going to win a second term. A miracle was needed, and, as it turned out, a miracle was provided.

In the end Donald Trump needed an extra 7.5 million votes to win re-election. Those votes were handed to him free of charge in the form of a tiny bug known to the world as coronavirus. It was a free gift for the New Year. And he blew it.

Up until that time anti-vaxxer sentiment was largely a left-leaning cause. Trump could have seized his golden opportunity to unite Republicans behind a quest for a coronavirus vaccine, meanwhile scrupulously following the science and gathering up as many of the fence-sitting undecided voters he could get his hands on. This was Trump’s chance to become a hero, his chance to be a true man of the people, however false that may have been in reality.

It was as if the forces of the universe had gathered together to give him one final shot at becoming president again. Instead, what did he do? He promoted crackpot “cures” and made breathtakingly stupid promises that the virus would “go away by Easter.” He made fun of the science of prevention, made fun of mask-wearing and encouraged people to violate safe and sane guidelines in the name of “freedom.”

He did what he always did, he divided the country right down the middle. He showed that he was a little man, a petty man, stupid, crude, uncouth and ultimately wrong about everything he said about the virus.

And he lost the election in a minor landslide. He kept the votes of the idiots who were going to vote for him anyway, of course, but people who had no reason to hate him suddenly hated him because they lost a loved one in the wholly unnecessary nationwide pandemic he caused. And they voted against him.

But that wasn’t enough for Donald Trump, oh no. Instead of going gentle into that good night, Donald Trump spent the last fourteen days of his presidency making sure that he would go to prison. He knew what was coming on the sixth of January and instead of provoking the people in the crowd he could have given a conciliatory speech and insisted that the people he knew were there to cause trouble stand down.

Most would have obeyed him but even if they hadn’t the insurrection would have plausibly been seen as not his fault, particularly if he’d immediately called up the national guard to defend the Capitol Building. But we all know what he did instead.

And as if that weren’t enough, upon leaving the White House he stole documents he didn’t need — classified and top secret documents, documents that were intrinsic to national security and could potentially put the nation’s nuclear secrets and personnel at risk to foreign agents. Not satisfied to merely start an insurrection that ended in multiple deaths and destruction to government property, Donald Trump also proved beyond a reasonable doubt that he is a thief.

All in the last fourteen days. Think of it yourself. If he hadn’t done those things there almost certainly would be no subsequent criminal probes, no January 6 Committee, no ominous talk about how many years he would serve when he became the first former president of the United States to go to prison.

If he couldn’t save his presidency in the last year he could have at least prevented the events of the last fourteen days and avoided going to prison. But he did the exact opposite, and because Donald John Trump is arrogant, stupid, narcissistic and blind, he is almost certainly going to be criminally indicted in 2023.

So now I’m going to say to you, brothers and sisters, what Republicans insist that we Democrats never say. Merry Christmas. Merry Christmas and a happy new year. The year 2023 could very well be the year the American people finally receive justice at last. And, as ever, ladies and gentlemen, brothers and sisters, comrades and friends, stay safe.

The post Donald Trump’s Christmas present to us all appeared first on Palmer Report.

Threat actors are actively exploiting a critical flaw in the YITH WooCommerce Gift Cards Premium WordPress plugin installed by over 50,000 websites.

Hackers are actively exploiting a critical vulnerability, tracked as CVE-2022-45359 (CVSS v3: 9.8), affecting the WordPress plugin YITH WooCommerce Gift Cards Premium.

The YITH WooCommerce Gift Cards Premium plugin allows websites of online stores to sell gift cards, a WordPress plugin used on over 50,000 websites.

The CVE-2022-45359 flaw is an Arbitrary File Upload issue that can allow an unauthenticated attacker to upload files to vulnerable sites, including web shells that provide full access to the site.

The issue was discovered on November 22, 2022, and was addressed with the release of version 3.20.0.

Due to the presence of a lot of websites that are still using vulnerable versions of the plugin, threat actors are exploring the flaw in attacks in the wild to upload backdoors on the e-stores.

“The Wordfence Threat Intelligence team has been tracking exploits targeting a Critical Severity Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards Premium, a plugin with over 50,000 installations according to the vendor.” reported Wordfence. “This allows attackers to place a back door, obtain Remote Code Execution, and take over the site.”

The researchers were able to reverse engineer the exploit and discovered that the issue lies in the import_actions_from_settings_panel function which runs on the admin_init hook.

The hook runs for any page in the /wp-admin/ directory and allows to trigger functions that run on it as an unauthenticated attacker by sending a request to /wp-admin/admin-post.php.

The experts noticed that the import_actions_from_settings_panel function also lacks a capability check and a CSRF check. An unauthenticated attacker can send POST requests to “/wp-admin/admin-post.php” using the certain parameters to upload a malicious PHP executable on the site.

“Since the import_actions_from_settings_panel function also lacks a capability check and a CSRF check, it is trivial for an attacker to simply send a request containing a page parameter set to yith_woocommerce_gift_cards_panel, a ywgc_safe_submit_field parameter set to importing_gift_cards, and a payload in the file_import_csv file parameter.” continues the report. “Since the function also does not perform any file type checks, any file type including executable PHP files can be uploaded.”

The experts added that it is possible to discover the attacks by analyzing the logs and checking unexpected POST requests to wp-admin/admin-post.php from unknown IP addresses.

Below are some files uploaded by threat actors in attacks analyzed by Wordfence:

• kon.php/1tes.php – this file loads a copy of the “marijuana shell” file manager in memory from a remote location (shell[.]prinsh[.]com)
• b.php – this file is a simple uploader
• admin.php – this file is a password-protected backdoor

Most of the attacks observed by Wordfence originated from 103.138.108.15 (19604 attacks against 10936 different sites) and 188.66.0.135 IP addresses (1220 attacks against 928 sites).

“The majority of attacks occurred the day after the vulnerability was disclosed, but have been ongoing, with another peak on December 14, 2022. As this vulnerability is trivial to exploit and provides full access to a vulnerable website we expect attacks to continue well into the future.” concludes the report.“

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, WordPress plugin)

The post Experts warn of attacks exploiting WordPress gift card plugin appeared first on Security Affairs.