Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

News & Commentary
DHS Warns of Data Theft via Chinese-Made Drones
Dark Reading Staff, Quick Hits
The drones are reportedly built with parts that can compromise organizations' data and share it on a server accessible to the Chinese government.
By Dark Reading Staff , 5/20/2019
Comment0 comments  |  Read  |  Post a Comment
97% of Americans Cant Ace a Basic Security Test
Steve Zurier, Contributing WriterNews
Still, a new Google study uncovers a bit of good news, too.
By Steve Zurier Contributing Writer, 5/20/2019
Comment3 comments  |  Read  |  Post a Comment
Financial Sector Under Siege
Marc Wilczek, Digital Strategist & CIO AdvisorCommentary
The old take-the-money-and-run approach has been replaced by siege tactics such as DDOS attacks and land-and-expand campaigns with multiple points of persistence and increased dwell time.
By Marc Wilczek Digital Strategist & CIO Advisor, 5/20/2019
Comment0 comments  |  Read  |  Post a Comment
Artist Uses Malware in Installation
Dark Reading Staff, Quick Hits
A piece of 'art' currently up for auction features six separate types of malware running on a vulnerable computer.
By Dark Reading Staff , 5/17/2019
Comment0 comments  |  Read  |  Post a Comment
When Older Windows Systems Won't Die
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft's decision to patch unsupported machines for the critical CVE-2019-0708 flaw is a reminder that XP, 2003, and other older versions of Windows still run in some enterprises.
By Kelly Sheridan Staff Editor, Dark Reading, 5/17/2019
Comment1 Comment  |  Read  |  Post a Comment
Exposed Elasticsearch Database Compromises Data on 8M People
Dark Reading Staff, Quick Hits
Personal data exposed includes full names, physical and email addresses, birthdates, phone numbers, and IP addresses.
By Dark Reading Staff , 5/17/2019
Comment0 comments  |  Read  |  Post a Comment
Google to Replace Titan Security Keys Affected by Bluetooth Bug
Kelly Sheridan, Staff Editor, Dark ReadingNews
A misconfiguration in Bluetooth Titan Security Keys' pairing protocols could compromise users under specific circumstances.
By Kelly Sheridan Staff Editor, Dark Reading, 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
Executive Order Limits Certain Tech Sales, Hits Huawei Hard
Dark Reading Staff, Quick Hits
The executive order signed by President Trump bars the sale or installation of equipment seen to be controlled by hostile foreign governments and a threat to national security.
By Dark Reading Staff , 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
Cyber Workforce Exec Order: Right Question, Wrong Answer
Ryan Shaw, Co-Founder, BionicCommentary
Shuffling resources, adding administrative process, and creating a competition and incentive system will do little to grow and mature the talent we need to meet the cybersecurity challenges we face.
By Ryan Shaw Co-Founder, Bionic, 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
New Intel Vulnerabilities Bring Fresh CPU Attack Dangers
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Four newly discovered vulns from the speculative-execution family bring Meltdown-like threats to Intel's processors.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 5/15/2019
Comment0 comments  |  Read  |  Post a Comment
Two Ransomware Recovery Firms Typically Pay Hackers
Dark Reading Staff, Quick Hits
Companies promising the safe return of data sans ransom payment secretly pass Bitcoin to attackers and charge clients added fees.
By Dark Reading Staff , 5/15/2019
Comment0 comments  |  Read  |  Post a Comment
Resolution Requires Cybersecurity Training for Members of Congress
Dark Reading Staff, Quick Hits
A bipartisan resolution would mandate IT and cybersecurity training for all members of Congress, their staff, and employees.
By Dark Reading Staff , 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft Patches Wormable Vuln in Windows 7, 2003, XP, Server 2008
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft releases security updates for some out-of-support systems to fix a bug that could be weaponized as a worm if exploited.
By Kelly Sheridan Staff Editor, Dark Reading, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Missing in Action: Cybersecurity Professionals
Andrea Fumagalli, Vice President of Engineering, DFLabsCommentary
Just as every organization security team's needs are unique, so are the reasons for the shortage of candidates for open positions. Here are five strategies to help you close the gap.
By Andrea Fumagalli Vice President of Engineering, DFLabs, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Effective Pen Tests Follow These 7 Steps
Curtis Franklin Jr., Senior Editor at Dark Reading
Third-party pen tests are part of every comprehensive security plan. Here's how to get the most from this mandatory investment.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
LockerGoga, MegaCortex Ransomware Share Unlikely Traits
Kelly Sheridan, Staff Editor, Dark ReadingNews
New form of ransomware MegaCortex shares commonalities with LockerGoga, enterprise malware recently seen in major cyberattacks.
By Kelly Sheridan Staff Editor, Dark Reading, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Attacks on JavaScript Services Leak Info From Websites
Robert Lemos, Contributing WriterNews
Three marketing tools, including the Best Of The Web security logomark, were compromised in supply chain attacks, allegedly leaving website customers leaking their users' sensitive information.
By Robert Lemos Contributing Writer, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Poorly Configured Server Exposes Most Panama Citizens' Data
Dark Reading Staff, Quick Hits
Compromised information includes full names, birth dates, national ID numbers, medical insurance numbers, and other personal data.
By Dark Reading Staff , 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
How Open Testing Standards Can Improve Security
Timothy Winters, Sr. Manager, UNH InterOperability LaboratoryCommentary
When creating security metrics, it's critical that test methodologies cover multiple scenarios to ensure that devices perform as expected in all environments.
By Timothy Winters Sr. Manager, UNH InterOperability Laboratory, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Demystifying the Dark Web: What You Need to Know
Kelly Sheridan, Staff Editor, Dark Reading
The Dark Web and Deep Web are not the same, neither is fully criminal, and more await in this guide to the Internet's mysterious corners.
By Kelly Sheridan Staff Editor, Dark Reading, 5/10/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Why AI Will Create Far More Jobs Than It Replaces
John DiLullo, CEO, Lastline,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Talk about vendor lock in...
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11816
PUBLISHED: 2019-05-20
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
CVE-2019-10076
PUBLISHED: 2019-05-20
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10077
PUBLISHED: 2019-05-20
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10078
PUBLISHED: 2019-05-20
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
CVE-2019-12239
PUBLISHED: 2019-05-20
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.