Researchers uncovers “ultimate man-in-the-middle attack” that used an elaborate spoofing campaign to fool a Chinese VC firm and rip off an emerging business.

Listen now!

The industry can only go so far in treating security as a challenge that can be resolved only by engineering.

Yodel’s mobile parcel delivery app was leaking people’s delivery data to others using the app, a security researcher discovered.

Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading

The authentication bypass (CVE-2019-19521) is remotely exploitable.

Android’s December 2019 updates arrived this week, patching a small list of system and Qualcomm flaws across the operating system’s two patch levels.

HackerOne has paid out $20,000 to a bounty hunter who discovered a session cookie issue, due to "human error," on the bug bounty platform.

Python developers have once again fallen victim to malicious software libraries lurking in their favourite package manager.

In the face of mounting attacks against critical infrastructure, NERC, which oversees the United States' electrical grid, is retooling how it addresses cybersecurity.

Former Dutch city council member Mitchel van der K invaded hundreds of iCloud accounts “frequently and repeatedly”.

The AdKoob malware that sneakily peeks at how much you’re spending on ads is back.

Authorities cracked down on cybercrime group Evil Corp. with sanctions and charges against its leader, known for his lavish lifestyle.

Names, addresses, phone numbers, call and text message records and account PINs were all caught up in a cloud misconfiguration.

Assessments can be used against your company in court proceedings. Here's how to mitigate this potential risk.

These outdated security rules we all know (and maybe live by) no longer apply.

Seeing its firewall sales softening, the security vendor makes another acquisition to reorient itself for the cloud era.

Maksim Yakubets and his crew stole tens of millions using Zeus and Dridex, with victims including Bank of America, Key Bank, GenLabs, and United Dairy, DoJ says.

Vulnerability in the Aviatrix VPN client, since patched, gives an attacker unlimited access to a breached system.

Security experts say the incident shows that cybercriminals are using ransomware to hit companies where it hurts.