The Pro CISO Newsletter

The security news our team thinks matters, about once a month · choose your topics · unsubscribe at any time

Cybersecurity Microsoft 365: let an app send mail from chosen mailboxes only Pro CISO · 17 Oct 2026 Granted the usual way in Entra ID, Mail.Send lets an application send as any mailbox in your organisation, the CEO's included. Our step-by-step guide registers the app, puts the al...
Cybersecurity Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack BleepingComputer · 17 Oct 2026 ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 te...
Cybersecurity Drupal patches critical RCE flaws, warns exploits may emerge soon BleepingComputer · 17 Oct 2026 Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [......
Cybersecurity ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down CyberPress · 17 Oct 2026 Attackers abused a compromised credential from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Jonathan Semon confirmed unauthorized sign...
Cybersecurity Encryption Is Getting Squeezed From All Sides Wired Security · 17 Oct 2026 Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.
Cybersecurity MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon The Hacker News · 17 Oct 2026 Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgde...
Cybersecurity Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel SecurityWeek · 17 Oct 2026 Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Cl...
Cybersecurity Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery in Under 30 Minutes CyberPress · 17 Oct 2026 Anthropic says an internal Claude research model identified how the NSA generated seeds for five prominent NIST elliptic curves in under 30 minutes, resolving a cryptographic prove...
Cybersecurity Hackers Exploit Critical WordPress Flaws to Execute Remote Code Without Authentication CyberPress · 17 Oct 2026 A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites by combining REST API route confusion with SQL injection...
Cybersecurity 37-Year-Old OpenBSD Kernel Flaw Lets Attackers Gain Root Access – PoC Released CyberPress · 17 Oct 2026 A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges. Published on October 16,...
Cybersecurity Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants The Hacker News · 17 Oct 2026 Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to...
Cybersecurity GhostAction Hackers Infect 94 GitHub Repositories With Fake Font Malware to Steal Credentials CyberPress · 17 Oct 2026 GhostAction attackers have compromised 94 GitHub repositories with a second-stage payload that disguises credential-stealing JavaScript as a font file. The campaign abuses Visual S...
Cybersecurity Indian Government Warns SideCopy Hackers Are Targeting Organizations With ReverseRAT Malware CyberPress · 17 Oct 2026 Indian authorities have warned that the SideCopy advanced persistent threat group is targeting Indian organizations, including academic institutions, with spear-phishing attacks th...
Cybersecurity OpenAI models hacked a crypto wallet and breached more websites Ars Technica Security · 16 Oct 2026 The actions could have resulted in criminal charges had humans been behind the keyboard.`
Cybersecurity Top Escape.tech alternatives for offensive security in 2026 Aikido Security · 16 Oct 2026 We compare the top Escape.tech alternatives for offensive security in 2026: Aikido Security, XBOW, RunSybil, Terra, Burp Suite Professional, Invicti, StackHawk, Hadrian, and Penter...