Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
How to Submit a Column to Dark Reading
7 Security Strategies as Employees Return to the Office
Inside the Ransomware Campaigns Targeting Exchange Servers
4 Open Source Tools to Add to Your Security Arsenal
News & Commentary
CISA Urges Caution for Security Researchers Targeted in Attack Campaign
Dark Reading Staff, Quick Hits
The agency urges researchers to take precautions amid an ongoing targeted threat campaign.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark ReadingNews
A court order authorized the FBI to remove malicious Web shells from hundreds of vulnerable machines running on-premise Exchange Server.
By Kelly Sheridan Staff Editor, Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
The CISO Life Is Half as Good
Sara Peters, Senior Editor at Dark Reading
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
By Sara Peters Senior Editor at Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing WriterNews
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
By Robert Lemos Contributing Writer, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack
Jai Vijayan, Contributing WriterNews
Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.
By Jai Vijayan Contributing Writer, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Compromised Microsoft Exchange Server Used to Host Cryptominer
Dark Reading Staff, Quick Hits
Researchers say an unknown attacker is targeting vulnerable Exchange Servers with a payload hosted on a compromised Exchange Server.
By Dark Reading Staff , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Global Dwell Time Drops as Ransomware Attacks Accelerate
Kelly Sheridan, Staff Editor, Dark ReadingNews
The length of time attackers remain undiscovered in a target network has fallen to 24 days, researchers report, but ransomware plays a role.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Dark Reading to Upgrade Site Design, Performance
Tim Wilson, Editor in Chief, Dark Reading, Commentary
Improvements will make site content easier to navigate, faster, and more functional.
By Tim Wilson, Editor in Chief, Dark Reading , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
5 Objectives for Establishing an API-First Security Strategy
Ryan Nolette, Technical Security Lead at PostmanCommentary
With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.
By Ryan Nolette Technical Security Lead at Postman, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Clear & Present Danger: Data Hoarding Undermines Better Security
Elissa M. Redmiles, Researcher, Max Planck Institute for Software SystemsCommentary
Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.
By Elissa M. Redmiles Researcher, Max Planck Institute for Software Systems, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Biden Nominates Former NSA Officials for Top Cybersecurity Roles
Kelly Sheridan, Staff Editor, Dark ReadingNews
President Biden has nominated Jen Easterly as the new director of CISA and is expected to nominate Chris Inglis as the first national cyber director.
By Kelly Sheridan Staff Editor, Dark Reading, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Warns of Malware Delivery via Google URLs
Dark Reading Staff, Quick Hits
A new campaign abuses legitimate website contact forms to send URLs that ultimately deliver the IcedID banking Trojan.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Federal Reserve Chairman Says Cyber-Risk a Top Threat to National Economy
Dark Reading Staff, Quick Hits
Jerome Powell tells 60 Minutes that cyberattacks have the potential to do major damage to US financial system.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Uses Machine Learning to Predict Attackers' Next Steps
Robert Lemos, Contributing WriterNews
Researchers build a model to attribute attacks to specific groups based on tactics, techniques, and procedures, and then figure out their next move.
By Robert Lemos Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
New Malware Downloader Spotted in Targeted Campaigns
Jai Vijayan, Contributing WriterNews
Saint Bot is being used to drop stealers on compromised systems but could be used to deliver any malware.
By Jai Vijayan Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Wake Up and Smell the JavaScript
Deepika Gajaria, VP of Products, Tala SecurityCommentary
The SolarWinds attack showed the true meaning of a supply chain breach. And it's the canary in the coal mine for sensitive data on the Web.
By Deepika Gajaria VP of Products, Tala Security, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Omdia Research Spotlight: XDR
Eric Parizo, Senior Analyst, OmdiaCommentary
Few emerging cybersecurity market segments are garnering more attention than XDR. Here, Omdia highlights its recent research on XDR.
By Eric Parizo Senior Analyst, Omdia, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Unofficial Android App Store APKPure Infected With Malware
Dark Reading Staff, Quick Hits
The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Vital Pandemic Industries Foster Unprecedented DDoS Attack Activity, NETSCOUT Threat Intelligence Report Finds
1Password Launches Secrets Automation & Makes Acquisition to Protect Infrastructure Secrets
Invicti Security Reports on Lost Year in Web Application Security
New Kaspersky Endpoint Security Cloud Upgraded With EDR for Small & Medium Businesses
SafeGuard Cyber Raises $45M In Strategic Growth Financing Led By NightDragon
CloudKnox Uncovers Permissions Gap Across Enterprise Hybrid & Multi-Cloud Environments
Beyond Identity Integration With Auth0 Enables Completely Passwordless Authentication
Imperva Research Labs Reveals Bot Traffic Climbs to Record High in 2020
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

9 Modern-Day Best Practices for Log Management
Log management is nothing new. But doing so smartly, correctly, and concisely in today's data-driven world is another story.
Name That Edge Toon: Rough Patch?
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
How to Build a Resilient IoT Framework
For all of their benefits, IoT devices weren't built with security in mind -- and that can pose huge challenges.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26030
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
CVE-2021-26031
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
CVE-2021-27710
PUBLISHED: 2021-04-14
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system funct...
CVE-2021-28484
PUBLISHED: 2021-04-14
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send i...
CVE-2021-29654
PUBLISHED: 2021-04-14
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.
Flash Poll
Video
Slideshows
Twitter Feed