Major Incidents or Breaches

  • Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
  • American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
  • An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
  • A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
  • Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

  • React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
  • Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
  • Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
  • Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

  • Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
  • State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
  • Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
  • Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

  • Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
  • DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
  • Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
  • Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
  • Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
  • Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

  • The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
  • India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.