Dark Reading Weekly -- November 10, 2022

Microsoft Quashes Bevy of Actively Exploited Zero-Days for November Patch Tuesday

Long-awaited security fixes for ProxyNotShell and Mark of the Web bypasses are part of a glut of actively exploited zero-day vulnerabilities and other critical flaws that admins need to prioritize in the coming hours.

Patch ASAP: Critical Citrix, VMware Bugs Threaten Remote Workspaces With Takeover

Hole-y software alert, Batman: Cybercriminal faves Citrix Gateway and VMware Workspace ONE have authentication-bypass bugs that could offer up total access to attackers.

SolarWinds Faces Potential SEC Enforcement Act Over Orion Breach

In the nearly two years since the company discovered the cyber intrusion, SolarWinds has fundamentally rearchitected its development environment to make it much harder to compromise, CISO Tim Brown tells Dark Reading.

W4SP Stealer Stings Python Developers in Supply Chain Attack

Threat actors continue to push malicious Python packages to the popular PyPI service, striking with typosquatting, authentic sounding file names, and hidden imports to fool developers and steal their information.

Oreo Giant Mondelez Settles NotPetya 'Act of War' Insurance Suit

The settlement muddies the waters even further for the viability of war exclusion clauses when it comes to cyber insurance.

RomCom Malware Woos Victims With 'Wrapped' SolarWinds, KeePass Software

An analysis of the RomCom APT shows the group is expanding its efforts beyond the Ukrainian military into the UK and other English-speaking countries.

Retail Sector Prepares for Annual Holiday Cybercrime Onslaught

Retailers and hospitality companies expect to battle credential harvesting, phishing, bots, and various malware variants.

Unencrypted Traffic Still Undermining Wi-Fi Security

An analysis by RSA Conference's security operations center found 20% of data over its network was unencrypted and more than 55,000 passwords were sent in the clear.

Cloud9 Malware Offers a Paradise of Cyberattack Methods

The Swiss Army knife-like browser extension is heaven for attackers — and can be hell for enterprise users.

What We Really Mean When We Talk About ‘Cybersecurity’

A lack of precision in our terminology leads to misunderstandings and confusion about the activities we engage in, the information we share, and the expectations we hold.

The Shifting Role of the CISO

My year as a venture capital CISO-in-residence.

Beyond the Pen Test: How to Protect Against Sophisticated Cybercriminals

Why are we still doing perfunctory penetration testing when we can be emulating realistic threats and stress-testing the systems most at risk?

Build Security Around Users: A Human-First Approach to Cyber Resilience

Security is more like a seat belt than a technical challenge. It's time for developers to shift away from a product-first mentality and craft defenses that are built around user behaviors.

A Better Way to Resist Identity-Based Cyber Threats

New approaches to identity access management are indispensable.

Instagram Star Gets 11 Years for Cybercrimes Used to Fund His Lavish Lifestyle

Prolific online scammer and social media influencer 'Hushpuppi' sentenced for bank cyber heists, BEC campaigns, money laundering, and more.

How Enterprises Are Attacking the Cybersecurity Problem