Major Incidents or Breaches

• Attackers have exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components, resulting in breaches at 30 organisations. Over 77,000 internet-exposed IP addresses remain vulnerable to this flaw.
• Kohler’s smart toilet cameras have been found to lack true end-to-end encryption, raising concerns about potential unauthorised access to video feeds.

Newly Discovered Vulnerabilities

• Over 30 security vulnerabilities have been identified in AI-powered Integrated Development Environments (IDEs). These flaws enable data theft and remote code execution attacks via prompt injection and related primitives.
• The React2Shell flaw (CVE-2025-55182), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, allows remote code execution in React Server Components and is under active exploitation.

Notable Threat Actor Activity

Major Incidents or Breaches

• Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
• American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
• An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
• A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
• Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.
• Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.
• Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
• Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
• French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
• Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
• The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
• WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Coupang, a major South Korean e-commerce platform, suffered a data breach compromising the personal information (names, addresses, email addresses, and phone numbers) of 33.7 million users over a five-month period.
• The University of Pennsylvania confirmed a data breach after attackers stole documents containing personal information from Oracle E-Business Suite servers in August.
• Korean authorities arrested four individuals for hacking over 120,000 IP cameras and selling intimate footage to a foreign adult site.
• The Shai-Hulud 2.0 npm malware attack exposed up to 400,000 developer secrets after infecting hundreds of npm packages and publishing stolen data in 30,000 GitHub repositories.
• Five Chrome and Edge browser extensions, with over 4 million installs, turned malicious after years of benign operation, acting as spyware and tracking users.
• Microsoft Defender XDR portal experienced a prolonged outage, disrupting access to security alerts and threat hunting capabilities for over 10 hours.
• OpenAI’s ChatGPT service suffered a global outage, with users unable to access conversations.
• Yearn Finance’s yETH pool on Ethereum was exploited for approximately $9 million via a critical vulnerability.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Coupang, South Korea’s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.
• The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.
• The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer’s signing keys, resulting in a malicious update being distributed to users.
• OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Asahi Group Holdings, Japan’s largest beer producer, has confirmed that a September cyberattack resulted in a data breach affecting up to 1.9 million individuals. The breach exposed personal information, including names, addresses, phone numbers, and email addresses.

Newly Discovered Vulnerabilities

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2021-26829, a cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is being actively exploited.

Notable Threat Actor Activity

Major Incidents or Breaches

• Asahi Group Holdings, Japan’s largest beer producer, confirmed a data breach affecting up to 1.9 million individuals following a September cyberattack.
• The French Football Federation (FFF) disclosed a data breach after attackers accessed administrative management software using a compromised account, resulting in the theft of member data.
• A security engineer discovered over 17,000 exposed secrets-including credentials and API keys-across more than 2,800 unique domains in public GitLab repositories.
• A 44-year-old individual was sentenced to over seven years in prison for operating “evil twin” WiFi networks at Australian airports to steal travelers’ data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The French Football Federation (FFF) disclosed a data breach following a cyberattack in which attackers used a compromised account to access administrative management software. Member data was confirmed stolen.
• More than 17,000 secrets were found exposed in public GitLab repositories, spanning over 2,800 unique domains, following a scan of all 5.6 million public GitLab Cloud repositories.
• A man was sentenced to over seven years in prison for operating “evil twin” WiFi networks to steal data from travelers at Australian airports.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• OpenAI disclosed a data breach affecting ChatGPT API customers, resulting from a compromise at third-party analytics provider Mixpanel. Limited identifying information of API customers was exposed. Multiple Mixpanel customers were impacted by the incident.
• Asahi, a Japanese company, suffered a ransomware attack that resulted in the theft of personal information of customers and employees, impacting approximately 2 million individuals and significantly disrupting operations.
• The CodeRED emergency alert system in the US experienced a ransomware attack, leading to a nationwide outage and a data breach, putting millions at risk.
• Amazon and the FBI have issued warnings regarding a surge in account takeover attacks targeting holiday shoppers, with scammers impersonating brands to gain access to user accounts.

Notable Threat Actor Activity