Major Incidents or Breaches

  • Attackers have exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components, resulting in breaches at 30 organisations. Over 77,000 internet-exposed IP addresses remain vulnerable to this flaw.
  • Kohler’s smart toilet cameras have been found to lack true end-to-end encryption, raising concerns about potential unauthorised access to video feeds.

Newly Discovered Vulnerabilities

  • Over 30 security vulnerabilities have been identified in AI-powered Integrated Development Environments (IDEs). These flaws enable data theft and remote code execution attacks via prompt injection and related primitives.
  • The React2Shell flaw (CVE-2025-55182), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, allows remote code execution in React Server Components and is under active exploitation.

Notable Threat Actor Activity

  • A new campaign is targeting Palo Alto GlobalProtect VPN portals with credential stuffing and brute-force login attempts. The same actors are conducting scanning activity against SonicWall SonicOS API endpoints.
  • Officials have issued warnings regarding a stealthy Chinese malware specimen exhibiting advanced evasion capabilities.

Trends, Tools, or Tactics of Interest

  • The exploitation of vulnerabilities in AI coding tools and IDEs through prompt injection highlights a trend towards targeting AI-assisted development environments.
  • The scale and speed of exploitation of the React2Shell vulnerability demonstrates increased attacker focus on supply chain and framework-level flaws in widely used web technologies.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has formally added the React2Shell vulnerability (CVE-2025-55182) to its Known Exploited Vulnerabilities catalogue, mandating accelerated remediation timelines for U.S. federal agencies and influencing global patch management priorities.
  • The U.S. administration has declined to issue sanctions in response to the Salt Typhoon hacking campaign, indicating a restrained policy stance on certain nation-state cyber activities.