Long-awaited security fixes for ProxyNotShell and Mark of the Web bypasses are part of a glut of actively exploited zero-day vulnerabilities and other critical flaws that admins need to prioritize in the coming hours.
| | | LATEST SECURITY NEWS & COMMENTARY | | Microsoft Quashes Bevy of Actively Exploited Zero-Days for November Patch Tuesday Long-awaited security fixes for ProxyNotShell and Mark of the Web bypasses are part of a glut of actively exploited zero-day vulnerabilities and other critical flaws that admins need to prioritize in the coming hours. Patch ASAP: Critical Citrix, VMware Bugs Threaten Remote Workspaces With Takeover Hole-y software alert, Batman: Cybercriminal faves Citrix Gateway and VMware Workspace ONE have authentication-bypass bugs that could offer up total access to attackers. SolarWinds Faces Potential SEC Enforcement Act Over Orion Breach In the nearly two years since the company discovered the cyber intrusion, SolarWinds has fundamentally rearchitected its development environment to make it much harder to compromise, CISO Tim Brown tells Dark Reading. W4SP Stealer Stings Python Developers in Supply Chain Attack Threat actors continue to push malicious Python packages to the popular PyPI service, striking with typosquatting, authentic sounding file names, and hidden imports to fool developers and steal their information. Oreo Giant Mondelez Settles NotPetya 'Act of War' Insurance Suit The settlement muddies the waters even further for the viability of war exclusion clauses when it comes to cyber insurance. RomCom Malware Woos Victims With 'Wrapped' SolarWinds, KeePass Software An analysis of the RomCom APT shows the group is expanding its efforts beyond the Ukrainian military into the UK and other English-speaking countries. Retail Sector Prepares for Annual Holiday Cybercrime Onslaught Retailers and hospitality companies expect to battle credential harvesting, phishing, bots, and various malware variants. Unencrypted Traffic Still Undermining Wi-Fi Security An analysis by RSA Conference's security operations center found 20% of data over its network was unencrypted and more than 55,000 passwords were sent in the clear. Cloud9 Malware Offers a Paradise of Cyberattack Methods The Swiss Army knife-like browser extension is heaven for attackers — and can be hell for enterprise users. What We Really Mean When We Talk About ‘Cybersecurity’ A lack of precision in our terminology leads to misunderstandings and confusion about the activities we engage in, the information we share, and the expectations we hold. The Shifting Role of the CISO My year as a venture capital CISO-in-residence. Beyond the Pen Test: How to Protect Against Sophisticated Cybercriminals Why are we still doing perfunctory penetration testing when we can be emulating realistic threats and stress-testing the systems most at risk? Build Security Around Users: A Human-First Approach to Cyber Resilience Security is more like a seat belt than a technical challenge. It's time for developers to shift away from a product-first mentality and craft defenses that are built around user behaviors. A Better Way to Resist Identity-Based Cyber Threats New approaches to identity access management are indispensable. Instagram Star Gets 11 Years for Cybercrimes Used to Fund His Lavish Lifestyle Prolific online scammer and social media influencer 'Hushpuppi' sentenced for bank cyber heists, BEC campaigns, money laundering, and more. MORE NEWS / MORE COMMENTARY | | |
| | | | | WEBINARS | | State of Bot Attacks: What to Expect in 2023 Malicious bots have moved past distributed denial-of-service and credential-stuffing attacks and are now capable of launching sophisticated attacks such as performing reconnaissance for future attacks, committing shopping cart and ticketing fraud, and engaging in clickjacking. Bot attacks are highly profitable ... Understanding Cyber Attackers & Their Methods Every day, your enterprise is at risk of being hacked. But just who are the cyber attackers, and what are their motivations? What methods might they use to crack enterprise data, and how do they stage their attacks? Do you ... | | View More Dark Reading Webinars >> |
|
| | | | |
|
Dark Reading Weekly
-- Published By Dark Reading
Informa Tech Holdings LLC | Registered in the United States
with number 7418737 | 605 Third Ave., 22nd Floor, New York, New York 10158, USA
| | To opt-out of any future Dark Reading Weekly Newsletter emails, please respond here. | | Thoughts about this newsletter? Give us feedback. |
Keep This Newsletter Out Of Your SPAM Folder
Don't let future editions go missing. Take a moment to add the newsletter's address to your anti-spam white list: | | If you're not sure how to do that, ask your administrator or ISP. Or check your anti-spam utility's documentation. | | We take your privacy very seriously. Please review our Privacy Statement. |
|
| |
