CISA urges devs to weed out OS command injection vulnerabilities

CISA and the FBI issued a joint advisory after Velvet Ant (a Chinese state‑sponsored group) exploited multiple OS command injection vulnerabilities (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887) to compromise Cisco, Palo Alto, and Ivanti network edge devices and deploy custom malware for persistence; the advisory urges developers and leaders to adopt secure-by-design practices (input validation, parameterization, safe library functions, limited user-built command parts, code review and testing) to eliminate CWE-78 class flaws.