Posts by Editorial Team
ConnectWise Supply Chain Attack Hits Microsoft 365
The ConnectWise supply chain attack now has a name behind it. Microsoft assesses that the China state-aligned group Storm-0940 used stolen credentials of ConnectWise cloud applications to sign in to customer Microsoft 365 tenants, with AI agents doing the work. Disabling the ConnectWise connection may not be enough, because the attackers could have added credentials…
Read MoreRank Math Supply Chain Attack Hits WordPress
A Rank Math supply chain attack put malware into the premium plugin’s update channel: version 3.0.123 of Rank Math PRO, downloaded or updated between October 15 (20:02 UTC) and October 16 (07:12 UTC), contained a backdoor. The window lasted about 11 hours. The vendor’s clean build is 3.0.124, and the free plugin from WordPress.org is…
Read MoreTop 5 Cybersecurity News
This week’s Top 5 Cybersecurity News for October 23, 2026 is about time. Attackers needed hours, and in one case started four days before public disclosure. Recovery asked for days: restores from clean backups, rotated credentials, client updates and, at one grocery group, more than a week without e-commerce. A flaw in PHP, the language…
Read MoreSafePay Ransomware Wipes Backups First
SafePay ransomware has compromised at least 600 organizations since August 2024, and a joint advisory published on October 20 says its operators halt shadow copies and reset backup storage before they encrypt anything. The FBI, CISA and the US Secret Service wrote it together with Germany’s Landeskriminalamt Rheinland-Pfalz and UK law enforcement (the National Crime…
Read MorePHP Critical Vulnerabilities Leaked Before Patch
Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team released the fix on October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.…
Read More