{"id":18410,"date":"2023-05-15T14:00:58","date_gmt":"2023-05-15T21:00:58","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=18410"},"modified":"2023-05-19T08:17:32","modified_gmt":"2023-05-19T15:17:32","slug":"securins-threat-intelligence-may-15-2023-may-19-2023","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-may-15-2023-may-19-2023\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: May 15, 2023 &#8211; May 19, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"18410\" class=\"elementor elementor-18410\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02c8318 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02c8318\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ddbe16e\" data-id=\"ddbe16e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3fa264 elementor-widget elementor-widget-text-editor\" data-id=\"a3fa264\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: center;\"><strong><span style=\"color: #000000;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context.<\/span><\/strong><\/p><p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: center;\"><strong><span style=\"color: #000000;\">Find out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d81a1c5 elementor-widget elementor-widget-heading\" data-id=\"d81a1c5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Watch our security expert David Rushton detail the top 3 threats of this week!\n<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d41b5d0 elementor-widget elementor-widget-text-editor\" data-id=\"d41b5d0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding:56.25% 0 0 0;position:relative;\"><iframe src=\"https:\/\/player.vimeo.com\/video\/828319017?h=7f0d735114&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allow=\"autoplay; fullscreen; picture-in-picture\" allowfullscreen style=\"position:absolute;top:0;left:0;width:100%;height:100%;\" title=\"CISA KEVs | Bl00dy Ransomware| BianLian Ransomware | May 19 | Securin Threat Intelligence Podcast\"><\/iframe><\/div><script src=\"https:\/\/player.vimeo.com\/api\/player.js\"><\/script>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f513b4 elementor-widget elementor-widget-spacer\" data-id=\"0f513b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06e09ce elementor-widget elementor-widget-heading\" data-id=\"06e09ce\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7532f9 elementor-widget elementor-widget-text-editor\" data-id=\"d7532f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#CISA-Adds-7-CVEs-to-the-KEV-Catalog\">CISA Adds 7 CVEs to the KEV Catalog<\/a><\/li><li><a href=\"#BianLian-Targets-Educational-Organizations\"><span style=\"font-weight: 400;\">BianLian Targets Educational Organizations<\/span><\/a><\/li><li><a href=\"#XMWorm-Attack-Campaign-Exploiting-Follina\">XMWorm Attack Campaign Exploiting Follina<\/a><\/li><li><a href=\"#Bl00dy-Ransomware-takes-on-Educational-Organizations\">Bl00dy Ransomware takes on Educational Organizations<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45e16b3 elementor-widget elementor-widget-heading\" data-id=\"45e16b3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78d7bb2 elementor-widget elementor-widget-text-editor\" data-id=\"78d7bb2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#Wordpress-Plugin-Vulnerabilities\">WordPress Plugin Vulnerabilities<\/a><\/li><li><a href=\"#CVE-2023-2156-Linux-IPv6-Zero-Day\">CVE-2023-2156: Linux IPv6 Zero-Day<\/a><\/li><li><a href=\"#Critical-Cisco-Vulnerabilities\"><span style=\"font-weight: 400;\">Critical Cisco Vulnerabilities<\/span><\/a><\/li><li><a href=\"#Zero-Day-Vulnerabilities-in-Apple-Products\">Zero-Day Vulnerabilities in Apple Products<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5581d4 elementor-hidden-mobile elementor-widget elementor-widget-spacer\" data-id=\"c5581d4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1272e27 elementor-widget elementor-widget-heading\" data-id=\"1272e27\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585df2e elementor-widget elementor-widget-spacer\" data-id=\"585df2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252bc8 elementor-widget elementor-widget-menu-anchor\" data-id=\"d252bc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CISA-Adds-7-CVEs-to-the-KEV-Catalog\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b8735e4 elementor-widget elementor-widget-heading\" data-id=\"b8735e4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CISA Adds 7 CVEs to the KEV Catalog<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06ef107 elementor-widget elementor-widget-text-editor\" data-id=\"06ef107\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-25717\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-25717<\/span><\/a><span style=\"font-weight: 400;\"> is a RCE vulnerability and impacts multiple Ruckus Wireless Products CSRF. An attacker does not require authentication to carry out these attacks and can gain access through crafted HTTP requests.\u00a0<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-3560\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-3560<\/span><\/a><span style=\"font-weight: 400;\"> is a Red Hat Polkit Incorrect Authorization vulnerability. Polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.\u00a0<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0196\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2014-0196<\/span><\/a><span style=\"font-weight: 400;\"> is a Linux Kernel Race Condition vulnerability that gives an unauthenticated attacker elevated privileges when exploited. Exploiting CVE-2014-0196 also allows an attacker to execute arbitrary code or perform a denial-of-service (DoS) attack by sending specially crafted network packets to a vulnerable system.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2010-3904\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2010-3904<\/span><\/a><span style=\"font-weight: 400;\"> is a Linux Kernel Improper Input Validation vulnerability. The vulnerability specifically affects the Apache HTTP Server versions 1.3.x and 2.x when configured with the mod_deflate module and the DEFLATE option enabled. The mod_deflate module is responsible for compressing server responses before sending them to the client, thereby reducing bandwidth usage. When a specially crafted request is sent to a vulnerable server, it can cause the server process to consume excessive CPU resources, leading to a denial of service condition. This can result in the server becoming unresponsive or crashing, preventing legitimate users from accessing the affected services.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-5317\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2015-5317<\/span><\/a><span style=\"font-weight: 400;\"> Jenkins User Interface (UI) Information Disclosure vulnerability. The vulnerability arises from a misconfiguration in CGI implementations that allow an attacker to set a malicious HTTP &#8220;Proxy&#8221; header, which can overwrite the HTTP_PROXY environment variable. This can lead to the proxying of subsequent HTTP requests made by the application, potentially resulting in sensitive information leakage or other malicious activities.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-3427\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2016-3427<\/span><\/a><span style=\"font-weight: 400;\"> Oracle Java SE and JRockit Unspecified vulnerability. The vulnerability allows an attacker to send a specially crafted query to a vulnerable BIND server, resulting in excessive memory consumption and potential resource exhaustion. This can lead to a denial of service condition, where the server becomes unresponsive or crashes.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-8735\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2016-8735 <\/span><\/a><span style=\"font-weight: 400;\">Apache Tomcat Remote Code Execution vulnerability. It is a privilege escalation vulnerability that allows an attacker to gain write access to read-only memory mappings in the Linux kernel. By exploiting this vulnerability, an attacker can modify read-only files, such as binaries or system libraries, and execute arbitrary code with elevated privileges.<\/span><\/p><p><strong>All these vulnerabilities need to be patched by June 2, 2023.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-17efa30 elementor-widget elementor-widget-spacer\" data-id=\"17efa30\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f47ead elementor-widget elementor-widget-menu-anchor\" data-id=\"2f47ead\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"BianLian-Targets-Educational-Organizations\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b471be elementor-widget elementor-widget-heading\" data-id=\"8b471be\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">BianLian Targets Educational Organizations<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b469b40 elementor-widget elementor-widget-text-editor\" data-id=\"b469b40\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Australian Cyber Security Centre (ACSC) have collaborated to release a joint advisory providing information on the activities of the BianLian ransomware and data extortion group. BianLian is a cybercriminal group that has been targeting organizations operating in critical infrastructure sectors in the United States and Australia since June 2022. To gain initial access to victim systems, BianLian exploits compromised Remote Desktop Protocol (RDP) credentials or employs phishing attacks. The group relies on open-source tools and command-line scripting to discover and harvest credentials from targeted systems. They exfiltrate the stolen data using various methods, including File Transfer Protocol (FTP), Rclone, or Mega.<\/span><\/p><p><span style=\"font-weight: 400;\">BianLian employs customized backdoors and utilizes remote management software such as TeamViewer, Atera Agent, SplashTop, or AnyDesk for persistence and command and control of compromised systems. They also leverage PowerShell and Windows Command Shell to evade detection and carry out activities such as reconnaissance and lateral movement within the victim&#8217;s network. In addition to their primary tactics, BianLian employs additional techniques to pressure victims into meeting their ransom demands. These include printing ransom notes on compromised network printers and making threatening phone calls to employees of the victim organizations.<\/span><\/p><p><span style=\"font-weight: 400;\">BianLian exploits <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-1472\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2020-1472<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-34523\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-34523<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-34473\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-34473<\/span><\/a><span style=\"font-weight: 400;\">, and <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-31207\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-31207<\/span><\/a><span style=\"font-weight: 400;\"> to gain initial access.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-93474c2 elementor-widget elementor-widget-spacer\" data-id=\"93474c2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dc74c9e elementor-widget elementor-widget-menu-anchor\" data-id=\"dc74c9e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"XMWorm-Attack-Campaign-Exploiting-Follina\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-13dc0cf elementor-widget elementor-widget-heading\" data-id=\"13dc0cf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\"> XMWorm Attack Campaign Exploiting Follina<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32bb1a4 elementor-widget elementor-widget-text-editor\" data-id=\"32bb1a4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A recent attack campaign had unusual methods involving meme-filled PowerShell code and an obfuscated XWorm payload. The attack starts with phishing emails distributing Microsoft Word documents that exploit the Follina vulnerability (<\/span><span style=\"font-weight: 400;\">CVE-2022-30190<\/span><span style=\"font-weight: 400;\">) to deploy an obfuscated PowerShell script, instead of using macros. The PowerShell script is abused by the threat actors to bypass Antimalware Scan Interface (AMSI), disable Microsoft Defender, establish persistence, and launch a .NET binary containing XWorm. The use of the variable &#8220;$CHOTAbheem&#8221; suggests a possible Middle Eastern\/Indian background of the attackers, although this attribution is yet to be confirmed.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">XWorm is a commodity malware sold on underground forums with various capabilities, including stealing sensitive information, performing clipper, DDoS, and ransomware operations, spreading through USB, and dropping additional malware. The origin of the threat actor is unclear, but the attack methodology shares similarities with TA558, a group known for targeting the hospitality industry. Despite the general avoidance of Microsoft Office documents in phishing emails due to disabled macros, this case highlights the importance of remaining vigilant and cautious with malicious document files.<\/span><\/p><p><span style=\"font-weight: 400;\">The FBI and CISA have jointly issued an advisory warning that the Bl00dy Ransomware gang is actively exploiting a remote-code execution vulnerability in PaperCut software to gain initial access to networks. The attacks by the threat actor have primarily targeted the education sector, which has a significant number of exposed vulnerabilities. The Bl00dy Ransomware gang gained access to education facility networks where PaperCut servers vulnerable to CVE-2023-27350 were exposed to the internet, resulting in data exfiltration and system encryption. The vulnerability has been under active exploitation since at least April 18, 2023, and organizations have been slow to install the necessary updates, leaving them vulnerable to attacks.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cbbe9aa elementor-widget elementor-widget-spacer\" data-id=\"cbbe9aa\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce6e898 elementor-widget elementor-widget-menu-anchor\" data-id=\"ce6e898\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"Bl00dy-Ransomware-takes-on-Educational-Organizations\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3ecb25b elementor-widget elementor-widget-heading\" data-id=\"3ecb25b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Bl00dy Ransomware Takes on Educational Organizations<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2b31c85 elementor-widget elementor-widget-text-editor\" data-id=\"2b31c85\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The FBI and CISA have jointly issued an <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa23-131a\" target=\"_blank\" rel=\"noopener\">advisory<\/a> warning that the Bl00dy Ransomware gang is actively exploiting a remote-code execution vulnerability in PaperCut software to gain initial access to networks in the education sector. There are several PaperCut servers vulnerable to <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-27350\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-27350<\/span><\/a><span style=\"font-weight: 400;\"> exposed to the internet, resulting in data exfiltration and system encryption.<\/span><\/p><p><span style=\"font-weight: 400;\">CVE-2023-27350 is a critical-severity remote code execution vulnerability affecting PaperCut MF and PaperCut NG, popular printing management software used by thousands of organizations globally. The attacks exploit the vulnerability to bypass user authentication, gain administrative access, spread laterally through the network, steal data, and encrypt target systems. Iranian hacking groups including &#8216;Muddywater,&#8217; have also joined in exploiting CVE-2023-27350 to achieve remote execution on their targets.<\/span><\/p><p><span style=\"font-weight: 400;\">The recommended action is to promptly apply available security updates for PaperCut MF and NG servers to address the exploited vulnerabilities.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36afe28 elementor-widget elementor-widget-spacer\" data-id=\"36afe28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0937f84 elementor-widget elementor-widget-heading\" data-id=\"0937f84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d574dff elementor-widget elementor-widget-spacer\" data-id=\"d574dff\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4d590 elementor-widget elementor-widget-menu-anchor\" data-id=\"ba4d590\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"Wordpress-Plugin-Vulnerabilities\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad4baf0 elementor-widget elementor-widget-heading\" data-id=\"ad4baf0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">WordPress Plugin Vulnerabilities<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-00ae11d elementor-widget elementor-widget-text-editor\" data-id=\"00ae11d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\"><strong><span style=\"color: #000000;\">Advanced Custom Fields:<\/span><\/strong> Hackers are actively exploiting a recently fixed vulnerability, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-30777\" target=\"_blank\" rel=\"noopener\">CVE-2023-30777<\/a><span style=\"font-weight: 400;\"> in the WordPress Advanced Custom Fields plugin shortly after a proof-of-concept (PoC) exploit was made public. It\u00a0 is a high-severity reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to steal sensitive information and escalate privileges on affected WordPress sites. The exploit targets logged-in users with access to the plugin, requiring them to run malicious code on their browser, granting high-privileged access to the site. The exploit works on default configurations of the affected plugin versions, making it easier for attackers to succeed without additional effort.<\/span><\/p><p><strong>WordPress site administrators are urged to apply the available <a href=\"https:\/\/plugins.trac.wordpress.org\/changeset\/2908095\/advanced-custom-fields\/tags\/6.1.6\/includes\/admin\/admin-internal-post-type-list.php?old=2892912&amp;old_path=advanced-custom-fields%2Ftrunk%2Fincludes%2Fadmin%2Fadmin-internal-post-type-list.php\" target=\"_blank\" rel=\"noopener\">patch<\/a><\/strong><span style=\"font-weight: 400;\"><strong> immediately to protect against ongoing scanning and exploitation.<\/strong> The recommended action is to upgrade the &#8216;Advanced Custom Fields&#8217; free and pro plugins to version 5.12.6 (backported) and 6.1.6.<\/span><\/p><p><strong><span style=\"color: #000000;\">Essential Addons for Elementor: <\/span><\/strong><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-32243\" target=\"_blank\" rel=\"noopener\">CVE-2023-32243<\/a> <span style=\"font-weight: 400;\">is an unauthenticated privilege escalation vulnerability in\u00a0 Essential Addons for Elementor, allowing any unauthenticated user to escalate their privileges to match any user on the WordPress site. The vulnerability enables an attacker to reset the password of any user if they know the username, including the administrator&#8217;s account, granting unauthorized access.<\/span><\/p><p><span style=\"font-weight: 400;\">The vulnerability arises from a lack of validation in the password reset function, which directly changes the password of the specified user without verifying a password reset key.<\/span><\/p><p><strong>The issue was <a href=\"https:\/\/plugins.trac.wordpress.org\/changeset?old_path=%2Fessential-addons-for-elementor-lite%2Ftags%2F5.7.1%2Fincludes%2FTraits%2FLogin_Registration.php&amp;old=2911002&amp;new_path=%2Fessential-addons-for-elementor-lite%2Ftags%2F5.7.2%2Fincludes%2FTraits%2FLogin_Registration.php&amp;new=2911002&amp;sfp_email=&amp;sfph_mail=\" target=\"_blank\" rel=\"noopener\">addressed<\/a> and fixed in version 5.7.2 of the plugin.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7809102 elementor-widget elementor-widget-spacer\" data-id=\"7809102\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-64f331c elementor-widget elementor-widget-menu-anchor\" data-id=\"64f331c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-2156-Linux-IPv6-Zero-Day\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-044f01e elementor-widget elementor-widget-heading\" data-id=\"044f01e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-2156: Linux IPv6 Zero-Day<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5d29cc elementor-widget elementor-widget-text-editor\" data-id=\"c5d29cc\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-2156\" target=\"_blank\" rel=\"noopener\">CVE-2023-2156<\/a> relates to the implementation of the Routing Protocol for Low-Power and Lossy Networks (RPL) in the IPv6 code section responsible for handling Routing headers. In IPv6, optional Extension Headers contain packet details and routing information. This critical bug arises from the interaction between the RPL implementation and the Linux Kernel&#8217;s code. An attacker can exploit it to trigger a kernel panic instead of allowing out-of-bounds access, thereby reducing vulnerabilities to denial-of-service bugs.<\/span><\/p><p><span style=\"font-weight: 400;\">There is no patch for it yet, although a proof-of-concept exists.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-05d16cb elementor-widget elementor-widget-spacer\" data-id=\"05d16cb\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1cac822 elementor-widget elementor-widget-menu-anchor\" data-id=\"1cac822\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"Critical-Cisco-Vulnerabilities\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b87376d elementor-widget elementor-widget-heading\" data-id=\"b87376d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Critical Cisco Vulnerabilities<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7425f33 elementor-widget elementor-widget-text-editor\" data-id=\"7425f33\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Cisco has issued a <\/span><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sg-web-multi-S9g4Nkgv\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">warning<\/span><\/a><span style=\"font-weight: 400;\"> to its customers regarding four critical vulnerabilities (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20159\" target=\"_blank\" rel=\"noopener\">CVE-2023-20159<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20160\" target=\"_blank\" rel=\"noopener\">CVE-2023-20160<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20161\" target=\"_blank\" rel=\"noopener\">CVE-2023-20161<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-20189\" target=\"_blank\" rel=\"noopener\">CVE-2023-20189<\/a>) that could allow remote code execution on multiple Small Business Series Switches. These vulnerabilities have received near-maximum severity ratings, with a CVSS base score of 9.8\/10.<\/span><\/p><p><span style=\"font-weight: 400;\">If successfully exploited, these vulnerabilities enable unauthenticated attackers to execute arbitrary code with root privileges on compromised devices. The vulnerabilities are independent of each other, meaning the exploitation of one vulnerability is not contingent on exploiting another. Additionally, a software release affected by one vulnerability may not necessarily be affected by the others.<\/span><\/p><p><span style=\"font-weight: 400;\">Firmware updates have been provided by Cisco to address the vulnerabilities in certain switch models, while others, such as the Small Business 200, 300, and 500 Series, will not receive patches due to being in the end-of-life phase. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a582e8b elementor-widget elementor-widget-spacer\" data-id=\"a582e8b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e778cc6 elementor-widget elementor-widget-menu-anchor\" data-id=\"e778cc6\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"Zero-Day-Vulnerabilities-in-Apple-Products\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4109e4 elementor-widget elementor-widget-heading\" data-id=\"d4109e4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Zero-Day Vulnerabilities in Apple Products<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a7cf16 elementor-widget elementor-widget-text-editor\" data-id=\"6a7cf16\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Apple has fixed three newly discovered zero-day vulnerabilities that were exploited in attacks aimed at hacking into iPhones, Macs, and iPads.<\/span><\/p><p><span style=\"font-weight: 400;\">The security bugs were found in the WebKit browser engine, which is used across multiple platforms. CVE-2023-32409 allows remote attackers to break out of Web Content sandboxes.<\/span><\/p><p><span style=\"font-weight: 400;\">CVE-2023-28204 and CVE-2023-32373 enable attackers to gain access to sensitive information and execute arbitrary code on compromised devices by tricking users into visiting maliciously crafted web pages.<\/span><\/p><p><br \/><strong>To address these zero-day vulnerabilities, Apple released <a href=\"https:\/\/support.apple.com\/en-us\/HT213757\" target=\"_blank\" rel=\"noopener\">updates<\/a><\/strong><span style=\"font-weight: 400;\"><strong> for macOS Ventura 13.4, iOS and iPadOS 16.5, tvOS 16.5, watchOS 9.5, and Safari 16.5.<\/strong> The updates include improved bounds checks, input validation, and memory management.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c37f4ec elementor-widget elementor-widget-spacer\" data-id=\"c37f4ec\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5661ac2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5661ac2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12cd24e\" data-id=\"12cd24e\" data-element_type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a79af4 elementor-widget elementor-widget-spacer\" data-id=\"6a79af4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8edd1c elementor-widget elementor-widget-text-editor\" data-id=\"f8edd1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #000000;\">Follow our weekly blog and podcast to get proactive alerts on trending threats.<\/span><\/strong><\/p><p style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers. <\/strong><a href=\"\/contact-us\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Talk to Us!<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b9a97 elementor-widget elementor-widget-spacer\" data-id=\"56b9a97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18410"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=18410"}],"version-history":[{"count":21,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18410\/revisions"}],"predecessor-version":[{"id":18516,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18410\/revisions\/18516"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=18410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=18410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=18410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}