Critical Elementor Pro bug exposes WordPress sites to RCE attacks

A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.

🔗️ [Bleepingcomputer] https://link.is.it/Ot4EO2

Insider Threat Report: Dark Web Recruitment & Access Trends

Flashpoint’s analysis of insider threat recruitment, illicit access advertising, and threat actor activity targeting enterprise environments.

🔗️ [Flashpoint] https://link.is.it/SHaRFW

How MSPs can catch phishing attacks email filters miss

AI is making phishing attacks more personalized, convincing, and difficult for traditional email filters to detect. Kaseya explains how MSPs can monitor identity, email, and endpoint activity to detect and contain attacks that make it past the inbox.

🔗️ [Bleepingcomputer] https://link.is.it/sHVReh

Senators press TikTok over withholding of safety features for some users

In a letter on Wednesday, Sens. Marsha Blackburn (R-TN) and Richard Blumenthal (D-CT) criticized the company for having “knowingly withheld a critical safety measure for millions of American users."

🔗️ [Therecord] https://link.is.it/VYduJn

Is Cyber missing the Marque?

In this week's newsletter, new author Mick Baccio introduces himself and explores the operational and security implications of the new White House memorandum regarding private sector participation in government-authorized offensive cyber operations.

🔗️ [Talosintelligence] https://link.is.it/qcySSh

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation.

🔗️ [Bleepingcomputer] https://link.is.it/YFsZuQ

China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware

Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.


🔗️ [Therecord] https://link.is.it/a9i8KK

Someone targeted security researchers using a fake crypto conference as a lure

A hacker pretending to work for a leading cryptocurrency news website targeted several cybersecurity professionals using Google Docs as a way to deliver malware.

🔗️ [Techcrunch] https://link.is.it/2rxtat

Il “will” del GDPR: la volontà che trasforma il dovere in accountability

Nel Regolamento Generale sulla Protezione dei Dati, il principio di accountability, che la traduzione italiana “responsabilizzazione” restituisce solo a metà, nasce da una coppia di verbi ausiliari. Ecco un grande assente, il verbo "will" del GDPR, che affonda le radici etimologiche nella volontà

🔗️ [Cybersecurity360] https://link.is.it/gCJGKL

SickKids data breach exposes employee and job applicant info

Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264)

🔗️ [Bleepingcomputer] https://link.is.it/1c7WL7

Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates

Explore ransomware attack vectors hiding in endpoint blind spots, from remote access tools and credentials to vendors, OT systems and phishing.

🔗️ [Cyble] https://link.is.it/oogPdG

Sorry guys, but the NVMe drive in my little server has officially dead! 🤦‍♂️

The feed is temporarily down. No data was lost (thankfully, backups exist for a reason 🙏).
I’ll have to wait for the replacement drive to arrive before bringing everything back online.

And of course, it decided to die at the best possible time in history 💸😂

If you’d like to support this project: https://buymeacoffee.com/andreadraghetti

Thanks ❤️