Dark Reading
3 years, 9 months ago
Credential Harvesting Is Retail Industry's Top Threat
Why bother with new tactics and exploits when the old tricks are still effective?
Security news aggregator
Latest coverage for Exploit
Stay informed on the latest exploit trends and vulnerabilities. Get expert insights and updates on information security exploits with our dedicated tag.
7
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
An exploit is code, data, or a sequence of actions that uses a software, hardware, or configuration vulnerability to produce unintended behavior. Depending on the flaw and the attacker’s access, it may enable unauthorized code execution, privilege escalation, information disclosure, or denial of service. Exploitation can occur remotely through exposed services, web applications, or client software, or locally after an attacker gains limited access.
Exploitation matters because a vulnerability becomes an active attack path when the required conditions are reachable and exploitable. Defenders should inventory affected assets, prioritize remediation when exploitation is known or credible, apply patches or vendor mitigations, and reduce exposure through access controls, segmentation, and secure configuration. Monitoring for exploit-specific indicators—such as abnormal requests, unexpected processes, or privilege changes—supports detection; systems suspected of successful exploitation require containment and investigation for follow-on access.
Showing 7 most recent headlines
Filtered view
Dark Reading
3 years, 9 months ago
macOS Archive Utility Bug Lets Malicious Apps Bypass Security Checks
Exploit allows unsigned and unnotarized macOS applications to bypass Gatekeeper and other security, without notifying the user.
Trend Micro Research, News and Perspectives
3 years, 9 months ago
How Water Labbu Exploits Electron-Based Applications
In the second part of our Water Labbu blog series, we explore how the threat actor exploits Electron-based applications using Cobalt Strike to deploy backdoors.
The Hacker News
3 years, 9 months ago
ProxyNotShell – the New Proxy Hell?
Nicknamed ProxyNotShell, a new exploit used in the wild takes advantage of the recently published Microsoft Server-Side Request Forgery (SSRF) vulnerability CVE-2022-41040 and a second vulnerability, CVE-2022-41082 that allows Remote Code Execution (RCE) when PowerShell is available to unidentified attackers
Bleeping Computer
3 years, 9 months ago
Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub
Scammers are impersonating security researchers to sell fake proof-of-concept ProxyNotShell exploits for newly discovered Microsoft Exchange zero-day vulnerabilities. [...]
Info Security Magazine
3 years, 9 months ago
Lazarus Group Exploits Dell Driver Vulnerability to Bypass Windows Security
ESET said the vulnerability was exploited at least twice via a specific user-mode module
The Hacker News
3 years, 9 months ago
Hackers Exploiting Dell Driver Vulnerability to Deploy Rootkit on Targeted Computers
The North Korea-backed Lazarus Group has been observed deploying a Windows rootkit by taking advantage of an exploit in a Dell firmware driver, highlighting new tactics adopted by the state-sponsored adversary