The PHP Bug That Hits Your Website and Your Firewall
Two critical PHP flaws let attackers run code on your server with no login. Here is what breaks, what is patched, and what to do this week.
Read post Insights
Cybersecurity & IT, without the noise.
Weekly posts on the threats, vulnerabilities, and practical steps that actually matter for small businesses. Researched thoroughly. Written plainly.
Extortion Crews Are Walking Into Law Offices. 7 Steps.
A Russian extortion gang sent people into US law firms posing as IT staff and delivery drivers. Here are seven things to do about it this month.
Read postThree Self-Hosted Tools, Three Live Exploits. A 7-Step Checklist.
Citrix NetScaler, Zimbra mail, and Zammad helpdesk are all being actively exploited right now. Here is a 7-step checklist for small businesses.
Read postMFA Won't Stop Token Theft. A 7-Step Microsoft 365 Checklist.
A researcher stole real Microsoft tokens through a signed Windows process after MFA passed. Here are seven steps to lock that down this week.
Read postRansomware Mostly Hits Small Firms Now. An 8-Step Checklist.
New Talos data shows small companies are now the bulk of ransomware victims. Here are eight things to fix, in order, starting this week.
Read postYour Remote Access Tools Are Under Attack. A 7-Step Checklist.
ScreenConnect, Check Point VPN, Cisco firewall managers and SonicWall are all being exploited right now. Here is what to check this week.
Read postMikroTik Routers Are Being Taken Over Without a Password
Attackers are chaining two RouterOS flaws to seize full control of internet-exposed MikroTik routers. Here's what to check and fix this week.
Read postClickFix: The Fake CAPTCHA That Gets Users to Infect Themselves
Attackers stopped sending malicious attachments. Now they talk your staff into pasting a command into Windows. Here is how ClickFix works and what stops it.
Read postYour Old Records Vendor Just Leaked 9.5 Million Patient Files
A healthcare data migration vendor lost records on 9.5 million people. Here is what small practices should ask their own vendors this week.
Read post400,000 WordPress Sites, One Plugin, Full Admin Takeover
A flaw in the TranslatePress plugin lets an attacker grab an admin password reset link and own the whole site. Here is what to check today.
Read postFake IT Help Desk on Teams Installs a Fake Windows Lock Screen
A new malware family called SynkLoader arrives as a Teams message from your IT help desk and steals the Windows password you type to unlock.
Read postA Stranger Offers to Unlock Your Ransomware. Do This Instead.
A rogue ransomware affiliate is emailing victims as a fake recovery firm before attacks go public. Here's the first-48-hours checklist for small firms.
Read postAttackers Are Exploiting a SharePoint Login Bypass. Patch It.
A critical SharePoint authentication bypass is under active attack after a proof-of-concept went public. Here's what small businesses need to do.
Read postRansomware Gangs Are Now Hitting SonicWall Remote Access. Patch Now.
CISA confirms ransomware crews are exploiting two SonicWall SMA1000 flaws. If your VPN runs on one, here's what to do this week.
Read postHackers Are Exploiting N-able N-central. Here's Why It Matters to You.
An auth bypass in a tool that manages your IT is under active attack. What N-able N-central is, why it's a target, and what to check now.
Read postThe ChatGPT Billing Email Is a Phishing Scam. Here's the Tell.
Fake ChatGPT and AI subscription renewal emails are landing at month-end to steal your payment details. Here's how to spot them and what to do.
Read postYour MFA Is On. Attackers Are Getting In Anyway.
MFA was on in 97% of credential attacks last year and still failed. Here's how attackers beat it, and what actually stops them.
Read postNew Microsoft 365 Phishing Kits Beat MFA: 6 Things to Do Now
Two new phishing kits, Jalisco and OmegaLord, are hijacking Microsoft 365 accounts and slipping past MFA. Here's a prioritized checklist to shut them down.
Read postMicrosoft's New Passkey Feature Is Being Used Against You
Attackers are calling Microsoft 365 users and walking them through a fake passkey setup. Here's what the feature does and what to do this week.
Read postDoes My Small Business Need EDR? A Plain-English Guide
EDR and MDR explained in plain words: what they are, the signs your small business needs them, and the real cost of going without. No jargon.
Read postMicrosoft 365 Security Checklist for Small Business
Twelve Microsoft 365 security settings every small business should have on, written as plain questions you can ask your IT person. No jargon needed.
Read postThe Phishing Kit That Beats Your MFA (And How It Works)
A new Microsoft 365 phishing toolkit steals login tokens and walks right past MFA. Here's how the attack works and how to stop it.
Read postThat UniFi Gear in Your Office Closet Is Being Hacked Right Now
CISA confirms attackers are exploiting three max-severity Ubiquiti UniFi flaws. If you run this gear, here's what to do today.
Read postHackers Are Selling Custom Credential Searches for Your Business
Stolen passwords are now a search service. Attackers can query for credentials tied to your specific company. Here's how to shut it down.
Read postA Click in Microsoft 365 Copilot Could Hand Over Your Email
A critical Copilot flaw let attackers steal email and files with one click. Plus a Cisco zero-day and a WordPress supply-chain attack.
Read postA WordPress Plugin Flaw Is Handing Hackers Admin Accounts
A critical bug in WP Maps Pro lets attackers create admin accounts on WordPress sites with no password. Here's what to do if you run one.
Read postHackers Are Breaking Into Palo Alto VPNs: Patch Now
A Palo Alto GlobalProtect VPN flaw is being actively exploited to break into business networks. Here's what's happening and what to do.
Read postTalk to the person who'll actually run your IT.
Book a free 15-minute consult. No sales pitch from a stranger, just a straight conversation about what your business needs.
Book your free consultOr call (732) 701-7012
Monthly agreements, not multi-year lock-ins · No call centers, ever