Major Incidents or Breaches

  • Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
  • Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
  • At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
  • A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
  • Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
  • The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

  • Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
  • Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
  • The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
  • A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
  • A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
  • Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
  • Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
  • Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

  • North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
  • Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
  • Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
  • At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
  • Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

  • Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
  • Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
  • There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
  • Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
  • The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
  • $320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
  • The Akira ransomware group continues to claim responsibility for significant breaches.
  • A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
  • Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
  • MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
  • Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
  • Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
  • The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
  • The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
  • The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.