Major Incidents or Breaches

  • SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
  • Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
  • PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
  • 700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

  • FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
  • Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
  • Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
  • React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
  • Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Notable Threat Actor Activity

  • Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
  • The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
  • Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
  • The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
  • SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Trends, Tools, or Tactics of Interest

  • Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
  • Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
  • Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
  • Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
  • A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
  • PayPal closed a loophole that allowed scammers to send legitimate-looking emails from [email protected], which were used to push tech support scams.
  • Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Regulatory or Policy Developments Affecting the Security Industry

  • Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
  • The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
  • Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
  • A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.