Light

Episode #858 Quiz

InControl
Date: 2022-02-15 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Google patched a Chrome use-after-free zero-day in animation and Apple patched an actively exploited WebKit use-after-free across iOS, iPadOS, macOS, and Safari. CISA ordered federal agencies to fix those and 15 other exploited flaws. Microsoft’s Patch Tuesday, Adobe’s Magento RCE, and WordPress PHP Everywhere showed risky patching and privilege escalation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specifically made the SeriousSAM vulnerability persist after patching on affected Windows systems?

Question 1

According to the episode, what specifically made the SeriousSAM vulnerability persist after patching on affected Windows systems?

The flaw was only removable by disabling Windows Defender Credential Guard first. The exploit remained viable until Microsoft rotated all local administrator passwords. The patch only changed registry ACLs and left the SAM database untouched. The patch had to be followed by manual deletion of volume shadow copies containing system files.

Question 2: What deadline did CISA set for Federal Civilian Executive Branch agencies to patch against the actively exploited Apple zero-day covered in the episode?

Question 2

What deadline did CISA set for Federal Civilian Executive Branch agencies to patch against the actively exploited Apple zero-day covered in the episode?

March 1st, 2022 February 24th, 2022 February 25th, 2022 August 10th, 2022

Question 3: In the episode, what exact abuse made PHP Everywhere especially dangerous on WordPress sites?

Question 3

In the episode, what exact abuse made PHP Everywhere especially dangerous on WordPress sites?

It allowed unauthenticated theme uploads that overwrote core templates. It allowed PHP snippets to be executed through WordPress shortcodes. It allowed direct shell access through the WordPress media library. It allowed SQL statements to be embedded in post metadata fields.

Question 4: What did Google report as the total amount paid out through its 2021 Vulnerability Reward Program?

Question 4

What did Google report as the total amount paid out through its 2021 Vulnerability Reward Program?

$8.7 million $3.0 million $1.5 million $3.3 million

Question 5: Which combination of product and average time-to-fix did the episode identify as the worst performer in Google's Project Zero stats?

Question 5

Which combination of product and average time-to-fix did the episode identify as the worst performer in Google's Project Zero stats?

Microsoft at 83 days Samsung at 73 days Apple WebKit at 72.7 days Oracle at 109 days

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.