https://blog.dansec.red/vendors/kohler/Recent content in Kohler on DanSec DailyHugoen-gbSun, 07 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-07-cybersecurity-news/Sun, 07 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-07-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Attackers have exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components, resulting in breaches at 30 organisations. Over 77,000 internet-exposed IP addresses remain vulnerable to this flaw.</li> <li>Kohler&rsquo;s smart toilet cameras have been found to lack true end-to-end encryption, raising concerns about potential unauthorised access to video feeds.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Over 30 security vulnerabilities have been identified in AI-powered Integrated Development Environments (IDEs). These flaws enable data theft and remote code execution attacks via prompt injection and related primitives.</li> <li>The React2Shell flaw (CVE-2025-55182), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, allows remote code execution in React Server Components and is under active exploitation.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>A new campaign is targeting Palo Alto GlobalProtect VPN portals with credential stuffing and brute-force login attempts. The same actors are conducting scanning activity against SonicWall SonicOS API endpoints.</li> <li>Officials have issued warnings regarding a stealthy Chinese malware specimen exhibiting advanced evasion capabilities.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The exploitation of vulnerabilities in AI coding tools and IDEs through prompt injection highlights a trend towards targeting AI-assisted development environments.</li> <li>The scale and speed of exploitation of the React2Shell vulnerability demonstrates increased attacker focus on supply chain and framework-level flaws in widely used web technologies.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA has formally added the React2Shell vulnerability (CVE-2025-55182) to its Known Exploited Vulnerabilities catalogue, mandating accelerated remediation timelines for U.S. federal agencies and influencing global patch management priorities.</li> <li>The U.S. administration has declined to issue sanctions in response to the Salt Typhoon hacking campaign, indicating a restrained policy stance on certain nation-state cyber activities.</li> </ul>