New Intel CPU attack. BlueKeep exploit module in Metasploit. Cyber Peace Institute non-profit.

Aside from the sheer absurdity of giving your attack the same name as a hugely popular networking tool, this is quite an interesting issue.
Intel processors have a shared cache that network devices can directly access. Researchers were able to leverage this access to listen in on an ongoing SSH session between the Intel server and another device.
I'm not sure how practical it is in the real world, but it's a nice bit of research, and the first network-based CPU side-channel attack. Intel acknowledged the problem and awarded a bounty.

If you run Exim servers, used for mail routing, you better patch up. No exploiting has been observed yet, but with 5 million exposed Exim servers that will only be a matter of time.

The much feared RDP vulnerability now has a module in Metasploit. It will determine wether or not a target is vulnerable, but requires some manual work and proper knowledge for actual exploitation.

Not an easy thing to fix no doubt, but good to be aware of. Patch gapping is making use of the delay between a patch being introduced in an open-source project and it being rolled out. Attackers can research the patch to discover the flaw, and exploit it before the patch makes it to production. To proof that it can be done, a researcher released exploit code for a security issue in Chrome's Javascript engine.

Avast researchers probed 4 million accounts of the GPS tracker manufacturer, and found 600.000 of them still using the default '123456' password. They point out that not only is this horrible for thecustomers, but also for the company itself, as the default accounts are automatically created during manufacturing. Any competitor can log in to them, change the password, and effectively lock out future buyers.

Very interesting. It seems that they intend to launch an organisation called the "Cyber Peace Institute". It will investigate and share analytical information on large-scale attacks against civilian targets, assess damages and assist where possible.

With deepfakes set to become a real problem, Facebook, Microsoft and other partners, have launched the Deepfake Detection Challenge (DFDC). It will include a data set and a leaderboard, and offer grants to produce technology that can prevent and detect deepfakes.
Great initiative. It's an arms race that I doubt we'll ever "win", but we'll surely lose if we don't fight.

Current US privacy laws are a patchwork of regulations, differing by state and industry. In an open letter the CEO's ask Congress for one unified privacy regulation, essentially like the GDPR.