SecurityWeek

A critical vulnerability impacting multiple IDEMIA biometric identification devices can be exploited to unlock doors and turnstiles.Because of this security defect, if the TLS protocol is not activated, an attacker in the network can send specific commands without authentication to open doors or turnstiles directly operated by a vulnerable device.

Oracle is preparing the release of nearly 500 new security patches with its Critical Patch Update (CPU) for January 2022.

A vulnerability in Apple’s implementation of the IndexedDB API in Safari 15 allows websites to track users’ activity on other sites and even to reveal their identity, browser fingerprinting and fraud detection firm FingerprintJS explains.

A critical vulnerability addressed recently in SAP NetWeaver AS ABAP and ABAP Platform could be abused to set up supply chain attacks, SAP security solutions provider SecurityBridge warns.

Fifteen acquisitions were announced in the first half of January 2022.

Nonprofit organization Goodwill has started notifying users of its ShopGoodwill.com e-commerce platform that their personal information was compromised as a result of a cybersecurity breach.

Newly detected WhisperGate malware being used by previously unknown threat group in cyberattacks against Ukraine

A Moscow court on Saturday remanded eight hackers in custody for two months as Russia cracks down on the REvil cybercrime group at Washington's request.

Ukraine said Sunday it had evidence that Russia was behind a massive cyberattack that knocked out key government websites this past week, as Microsoft warned the hack could be far worse than first thought.

Hackers on Friday temporarily shut down dozens of Ukrainian government websites, causing no major damage but adding to simmering tensions while Russia amasses troops on the Ukrainian border. Separately, in a rare gesture to the U.S. at a time of chilly relations, Russia said it had arrested members of a major ransomware gang that targeted U.S. entities.

Researchers at cloud security startup Orca Security have publicly documented a pair of vulnerabilities in AWS CloudFormation and AWS Glue that attackers could use to leak sensitive files or access other customers’ data.

A new ruling from the Austrian Data Protection Authority (DPA) traps EU/U.S. data transfers between a rock and hard place. The rock is GDPR. The hard place is FISA. And the two are fundamentally incompatible.

North Korea-linked hacking group Lazarus stole close to $400 million worth of crypto-assets last year, Chainalysis reports.

When the superintendent of Albuquerque Public Schools announced earlier this week a cyber attack would lead to the cancellation of classes for around 75,000 students, he noted that the district’s technology department had been fending off attacks “for the last few weeks.”

Russia on Friday said it has cracked down on the infamous REvil hacking group, known for its high profile supply chain attack against software maker Kaseya, and a ransomware attack against JBS USA that forced the shutdown of a portion of the world's largest meat processing company.

A recently observed GootLoader campaign has been focusing on infecting the devices of legal and accounting company employees with malware, eSentire reports.

The government of El Salvador has denied using the Israeli Pegasus software to spy on journalists and activists.

Kyiv on Friday reported a massive cyber attack on key government websites as tensions between Russia and the West over Ukraine escalate following several rounds of unsuccessful talks.The education ministry said on Facebook that its website was down due to a "global (cyber) attack" that had taken place overnight.

A leading Maryland lawmaker said Thursday that top legislators were misled about the seriousness of a cyberattack on the state health department.