The flaw could allow attackers to bypass Privacy preferences, giving apps with no right to access files, microphones or cameras the ability to record you or grab screenshots.

https://threatpost.com/macos-bug-snooping-microsoft/177551/

Record-number WordPress plugin vulnerabilities are wicked exploitable even with low CVSS scores, leaving security teams blind to their risk.

https://threatpost.com/wordpress-bugs-exploded-2021-exploitable/177553/

Researchers offer more detail on the bug, which can allow attackers to completely take over targets.

https://threatpost.com/sonicwall-nac-vulnerability-apache-mods/177529/

The high-severity RCE flaw is in the KCodes NetUSB kernel module, used by popular routers from Netgear, TP-Link, DLink, Western Digital, et al.

https://threatpost.com/millions-routers-exposed-bug-usb-module-kcodes-netusb/177506/

Dangerous security bugs stemming from widespread inconsistencies among 16 popular third-party URL-parsing libraries could affect a wide swath of web applications.

https://threatpost.com/url-parsing-bugs-dos-rce-spoofing/177493/

Cyberattacks increased 50 percent YoY in 2021 and peaked in December due to a frenzy of Log4j exploits, researchers found.

https://threatpost.com/cyber-spike-attacks-high-log4j/177481/

End of life, end of support, pandemic-induced shipping delays and remote work, scanning failures: It’s a recipe for a patching nightmare, federal cyberserurity CTO Matt Keller says.

https://threatpost.com/eol-systems-stonewalling-log4j-fixes-for-fed-agencies/177475/

Fertility Centers of Illinois’ security measures protected electronic medical records, but the attackers still got at extremely intimate data in admin files.

https://threatpost.com/cyberattackers-data-80k-patients-fertility-centers-illinois/177467/

There are active ransomware and brute-force attacks being launched against internet-exposed, network-attached storage devices, the device maker warned.

https://threatpost.com/qnap-nas-devices-ransomware-attacks/177452/

Critical flaw in the H2 open-source Java SQL database are similar to the Log4J vulnerability, but do not pose a widespread threat.

https://threatpost.com/log4j-related-flaw-h2-database/177448/

ESXi version 7 users are still waiting for a full fix for a high-severity heap-overflow security vulnerability, but Cloud Foundation, Fusion and Workstation users can go ahead and patch.

https://threatpost.com/unpatched-vmware-bug-hypervisor-takeover/177428/

A wave of phishing attacks identified in December targeting mainly Outlook users are difficult for both email scanners and victims to flag, researchers said.

https://threatpost.com/attackers-exploit-flaw-google-docs-comments/177412/

The group blends into an environment before loading up trivial, thickly stacked, fraudulent financial transactions too tiny to be noticed but adding up to millions of dollars.

https://threatpost.com/elephant-beetle-months-networks-financial/177393/

More than 1.3 million patient records were stolen in the just-disclosed breach, which occurred back in October.

https://threatpost.com/broward-breach-healthcare-supply-chain/177401/

A simple-to-exploit bug that allows bad actors to send emails from Uber’s official system – skating past email security – went unaddressed despite multiple flagging by researchers.

https://threatpost.com/uber-bug-ignored-emails/177395/

Companies that fail to protect consumer data from Log4J attacks are at risk of facing Equifax-esque legal action and fines, the FTC warned.

https://threatpost.com/ftc-pursue-companies-log4j/177368/

Microsoft says it’s only going to get worse: It’s seen state-sponsored and cyber-criminal attackers probing systems for the Log4Shell flaw through the end of December.

https://threatpost.com/microsoft-rampant-log4j-exploits-testing/177358/

SEGA’s disclosure underscores a common, potentially catastrophic, flub — misconfigured Amazon Web Services (AWS) S3 buckets.

https://threatpost.com/sega-security-aws-s3-exposed-steam/177352/

Expect many more zero-day exploits in 2022, and cyberattacks using them being launched at a significantly higher rate, warns Aamir Lakhani, researcher at FortiGuard Labs.

https://threatpost.com/rise-cyber-recon-security-strategy/177317/

Researchers from CrowdStrike disrupted an attempt by the threat group to steal industrial intelligence and military secrets from an academic institution.

https://threatpost.com/aquatic-panda-log4shell-exploit-tools/177312/