VulnHub

MITRE has released its Top 25 list of dangerous software weaknesses for 2025, based on an analysis of nearly 40,000 Common Vulnerabilities and Exposures (CVEs). This list identifies the most critical flaws that could be exploited by attackers, affecting a wide range of software and hardware products. Developers and organizations need to be aware of these vulnerabilities to improve their security measures and protect against potential breaches. The findings serve as a crucial resource for cybersecurity professionals aiming to prioritize their efforts in addressing these weaknesses. By understanding and mitigating these risks, companies can better safeguard their systems and data from malicious actors.

The UK’s National Cyber Security Centre (NCSC) is urging businesses to implement the Cyber Essentials framework within their supply chains. This initiative aims to enhance cybersecurity practices among suppliers, which are often the weakest link in a company’s security posture. By adopting these guidelines, businesses can better protect themselves from cyber threats that may arise from third-party vendors. The NCSC emphasizes that this step is crucial for safeguarding sensitive data and maintaining customer trust. As cyber attacks become more sophisticated, ensuring that suppliers meet certain cybersecurity standards is essential for overall security.

Microsoft has acknowledged that its December 2025 security updates are causing failures in Message Queuing (MSMQ) functionality. This issue is impacting enterprise applications and Internet Information Services (IIS) websites, potentially disrupting business operations. Users and organizations relying on these services may experience significant downtime and communication issues, as MSMQ is crucial for message delivery in distributed applications. Microsoft has not yet provided specific patches or workarounds to resolve this problem, leaving affected users in a challenging situation until a fix is released. This situation highlights the importance of thorough testing of security updates before deployment, especially in enterprise environments.

A new report from the Center for Cybersecurity Policy and Law raises concerns about mobile security as the European Union's Digital Markets Act (DMA) takes effect. The DMA mandates that major platform providers allow third-party developers access to key software and hardware features for better interoperability. While this aims to foster competition, experts warn it could weaken the security controls that have traditionally protected mobile devices. As apps and services become more interconnected through these new regulations, there is a risk that vulnerabilities could be introduced, potentially exposing user data and device integrity. This shift could affect millions of users across various mobile ecosystems, raising urgent questions about how security will be maintained in a more open environment.

The latest Security Affairs Malware Newsletter highlights several significant malware developments affecting multiple countries. Notably, the UDPGangster campaigns are targeting various regions, posing risks to users and organizations. Researchers also discuss ransomware trends related to the Bank Secrecy Act, shedding light on how financial institutions might be affected between 2022 and 2024. Additionally, the return of the ClayRat malware introduces expanded features and techniques that could complicate detection and mitigation efforts. Another concerning finding is the SEEDSNATCHER, an Android malware that targets crypto wallets, raising alarms for cryptocurrency users. These incidents highlight the evolving tactics employed by cybercriminals and the need for heightened security measures.

A significant security oversight was uncovered when researchers found an unsecured 16TB MongoDB database that exposed approximately 4.3 billion professional records. This database primarily contained LinkedIn-style data, which could be exploited for large-scale AI-driven social engineering attacks. The discovery was made by Bob Diachenko and nexos.ai on November 23, 2025, and the database was secured only after the researchers alerted its owner. This incident underscores the risks associated with unsecured databases, as the exposed data could facilitate identity theft and phishing schemes targeting professionals. Organizations need to ensure better security measures for their data to prevent such breaches in the future.

The UK's Information Commissioner's Office (ICO) has imposed a £1.2 million fine on LastPass following a significant data breach in 2022 that compromised the personal information of 1.6 million users. The breach was traced back to a vulnerability in an employee's personal computer, which allowed attackers to access sensitive data. This incident raises serious concerns about the security practices of password management services, especially considering the potential for misuse of the exposed information. Users of LastPass are now at increased risk of phishing attacks and identity theft. The fine serves as a reminder for companies to enhance their cybersecurity measures and protect user data more effectively.

Coupang, a major South Korean e-commerce platform, recently suffered a significant data breach that compromised the personal information of approximately 33.7 million customers. Investigations revealed that the breach was the result of a former employee who had retained access to the company's internal systems after leaving. This situation raises serious concerns about how companies manage access permissions for departing employees. The exposed data could include sensitive customer information, potentially leading to identity theft or fraud. This incident serves as a reminder for businesses to regularly review and update their access control policies to safeguard against similar breaches in the future.