Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
How to Submit a Column to Dark Reading
7 Security Strategies as Employees Return to the Office
Inside the Ransomware Campaigns Targeting Exchange Servers
4 Open Source Tools to Add to Your Security Arsenal
News & Commentary
Nation-State Attacks Force a New Paradigm: Patching as Incident Response
Fred Langston, Executive Vice President of Professional Services and Co-Founder, CI SecurityCommentary
IT no longer has the luxury of thoroughly testing critical vulnerability patches before rolling them out.
By Fred Langston Executive Vice President of Professional Services and Co-Founder, CI Security, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Malicious PowerShell Use, Attacks on Office 365 Accounts Surged in Q4
Jai Vijayan, Contributing WriterNews
There was also a sharp increase in overall malware volumes in the fourth quarter of 2020, COVID-19 related attack activity, and mobile malware, new data shows.
By Jai Vijayan Contributing Writer, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Thycotic & Centrify Merge to Form Cloud Identity Security Firm
Dark Reading Staff, Quick Hits
The combined entity will expand on both companies' privileged access management tools and expects to debut a new brand this year.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Urges Caution for Security Researchers Targeted in Attack Campaign
Dark Reading Staff, Quick Hits
The agency urges researchers to take precautions amid an ongoing targeted threat campaign.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark ReadingNews
A court order authorized the FBI to remove malicious Web shells from hundreds of vulnerable machines running on-premises Exchange Server.
By Kelly Sheridan Staff Editor, Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
The CISO Life Is Half as Good
Sara Peters, Senior Editor at Dark Reading
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
By Sara Peters Senior Editor at Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing WriterNews
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
By Robert Lemos Contributing Writer, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack
Jai Vijayan, Contributing WriterNews
Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.
By Jai Vijayan Contributing Writer, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Compromised Microsoft Exchange Server Used to Host Cryptominer
Dark Reading Staff, Quick Hits
Researchers say an unknown attacker is targeting vulnerable Exchange Servers with a payload hosted on a compromised Exchange Server.
By Dark Reading Staff , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Global Dwell Time Drops as Ransomware Attacks Accelerate
Kelly Sheridan, Staff Editor, Dark ReadingNews
The length of time attackers remain undiscovered in a target network has fallen to 24 days, researchers report, but ransomware plays a role.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment1 Comment  |  Read  |  Post a Comment
Dark Reading to Upgrade Site Design, Performance
Tim Wilson, Editor in Chief, Dark Reading, Commentary
Improvements will make site content easier to navigate, faster, and more functional.
By Tim Wilson, Editor in Chief, Dark Reading , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
5 Objectives for Establishing an API-First Security Strategy
Ryan Nolette, Technical Security Lead at PostmanCommentary
With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.
By Ryan Nolette Technical Security Lead at Postman, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Clear & Present Danger: Data Hoarding Undermines Better Security
Elissa M. Redmiles, Researcher, Max Planck Institute for Software SystemsCommentary
Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.
By Elissa M. Redmiles Researcher, Max Planck Institute for Software Systems, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Biden Nominates Former NSA Officials for Top Cybersecurity Roles
Kelly Sheridan, Staff Editor, Dark ReadingNews
President Biden has nominated Jen Easterly as the new director of CISA and is expected to nominate Chris Inglis as the first national cyber director.
By Kelly Sheridan Staff Editor, Dark Reading, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Warns of Malware Delivery via Google URLs
Dark Reading Staff, Quick Hits
A new campaign abuses legitimate website contact forms to send URLs that ultimately deliver the IcedID banking Trojan.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Federal Reserve Chairman Says Cyber-Risk a Top Threat to National Economy
Dark Reading Staff, Quick Hits
Jerome Powell tells 60 Minutes that cyberattacks have the potential to do major damage to US financial system.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Uses Machine Learning to Predict Attackers' Next Steps
Robert Lemos, Contributing WriterNews
Researchers build a model to attribute attacks to specific groups based on tactics, techniques, and procedures, and then figure out their next move.
By Robert Lemos Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
New Malware Downloader Spotted in Targeted Campaigns
Jai Vijayan, Contributing WriterNews
Saint Bot is being used to drop stealers on compromised systems but could be used to deliver any malware.
By Jai Vijayan Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Vital Pandemic Industries Foster Unprecedented DDoS Attack Activity, NETSCOUT Threat Intelligence Report Finds
1Password Launches Secrets Automation & Makes Acquisition to Protect Infrastructure Secrets
Invicti Security Reports on Lost Year in Web Application Security
New Kaspersky Endpoint Security Cloud Upgraded With EDR for Small & Medium Businesses
SafeGuard Cyber Raises $45M In Strategic Growth Financing Led By NightDragon
CloudKnox Uncovers Permissions Gap Across Enterprise Hybrid & Multi-Cloud Environments
Beyond Identity Integration With Auth0 Enables Completely Passwordless Authentication
Imperva Research Labs Reveals Bot Traffic Climbs to Record High in 2020
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

The CISO Life Is Half as Good
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
9 Modern-Day Best Practices for Log Management
Log management is nothing new. But doing so smartly, correctly, and concisely in today's data-driven world is another story.
Name That Edge Toon: Rough Patch?
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-0488
PUBLISHED: 2021-04-15
In pb_write of pb_encode.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-178754781
CVE-2021-27129
PUBLISHED: 2021-04-15
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
CVE-2021-27544
PUBLISHED: 2021-04-15
Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "sername" parameter.
CVE-2021-27545
PUBLISHED: 2021-04-15
SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sensitive database information by injecting SQL commands into the "sername" parameter.
CVE-2020-7270
PUBLISHED: 2021-04-15
Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deploye...
Flash Poll
Video
Slideshows
Twitter Feed