Security Alerts

No phishing email, no unpatched server. An IT administrator searched for a piece of software he already used, downloaded it from the top result, and the whole network was encrypted two days later.

Attackers got Meta's own systems to send the phishing email for them, from a genuine Facebook address. If your business runs a Facebook page or pays for ads, this is the one to understand.

A tracking script used by thousands of sites was tampered with for a day. Every site carrying it served the attackers' code to visitors, and none of those site owners did anything wrong.

One web page that did not check what people typed into it. From there, attackers took the server, switched off its defences and put it to work making money for somebody else.

Two flaws in WordPress itself, chained together, handed complete control of a site to anyone who asked. Patched on 17 July. Here is how to be sure yours is on a safe version.

Criminals rang staff claiming to be internal IT, sent them to a fake login page, and used the sign-in to reach Microsoft Entra and SharePoint. What to put in place this week.

CISA now records ransomware crews exploiting two SonicWall SMA1000 flaws. The fix has been out since mid-July, yet 380-odd appliances are still exposed. How to tell if one is yours.

Cisco Talos published what it actually saw last quarter across the incidents it was called into. Two of the numbers should change how a small business spends its next hour on security.

Attackers poisoned a data feed used by seven popular Elementor plugins, creating hidden administrator accounts on sites that had done nothing wrong. Here is how to check yours.