Exploits and vulnerabilities in Q4 2025

Securelist

March 6, 2026 at 10:00 AM

Overview

The report details the vulnerabilities and exploits identified during the fourth quarter of 2025, with a focus on their impact on various systems and the rising use of command-and-control (C2) frameworks in advanced persistent threat (APT) attacks. Researchers noted an increase in published vulnerabilities, which could affect numerous organizations and users relying on these systems. The report emphasizes the importance of timely patching and updating to mitigate risks associated with these vulnerabilities. As APT groups increasingly employ sophisticated C2 frameworks, organizations must enhance their security measures to protect against potential breaches. This summary of findings is crucial for cybersecurity professionals aiming to stay ahead of evolving threats and safeguard their networks.

Key Takeaways

Affected Systems: Various systems and applications affected by newly identified vulnerabilities; specific products not detailed.
Action Required: Organizations should prioritize patching and updating their systems in response to the newly identified vulnerabilities.
Timeline: Disclosed on Q4 2025

Original Article Summary

This report provides statistical data on published vulnerabilities and exploits we researched during Q4 2025. It also includes summary data on the use of C2 frameworks in APT attacks.

Impact

Various systems and applications affected by newly identified vulnerabilities; specific products not detailed.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on Q4 2025

Remediation

Organizations should prioritize patching and updating their systems in response to the newly identified vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to APT.

Read Original Article

Related Coverage

CVE-2026-35616: FortiClient EMS Flaw Actively Exploited in Malware Attacks

Security Affairs

A recently identified vulnerability in FortiClient Endpoint Management Server (EMS), tracked as CVE-2026-35616, is being actively exploited to deploy information-stealing malware, according to a report from Arctic Wolf. This flaw has a high severity rating of 9.1 and allows attackers to execute remote code without needing authentication, making it particularly dangerous. Organizations using FortiClient EMS should be on high alert as the vulnerability can be exploited through specially crafted requests. The vulnerability was patched in April, but the ongoing exploitation highlights the importance of timely updates and monitoring for suspicious activity. Companies must ensure they have applied the latest patches to protect their systems from these attacks.

May 28, 2026

Attackers Move Past Typosquatting to Realistic Package Impersonation

Infosecurity Magazine

Recent research shows that cybercriminals have shifted tactics from typosquatting—where they create malicious packages with misspelled names—to developing more sophisticated open source packages that closely mimic legitimate code. This new approach allows attackers to trick users into downloading and installing harmful software without them realizing it. The implications are significant, as developers and organizations relying on open source software may inadvertently use these compromised packages, leading to potential data breaches or system vulnerabilities. Users must remain vigilant and verify the authenticity of packages before installation to prevent falling victim to these impersonation tactics.

May 28, 2026

Man arrested in Netherlands for hacking Ajax football club

SCM feed for Latest

A man was arrested in Buren, Netherlands, for allegedly hacking into the computer systems of Ajax, a prominent football club. The suspect is accused of unauthorized access to Ajax's systems multiple times earlier this year. This incident raises concerns about the security of sports organizations, which can be vulnerable to cyberattacks that may compromise sensitive data or disrupt operations. The arrest reflects ongoing efforts by law enforcement to tackle cybercrime and protect digital assets in the sports industry. As cyber threats grow, it is crucial for organizations to bolster their cybersecurity measures to prevent similar incidents in the future.

May 28, 2026

New Gogs zero-day flaw lets hackers get remote code execution

BleepingComputer

A newly discovered zero-day vulnerability in the Gogs self-hosted Git service allows attackers to execute remote code on servers that are exposed to the internet. This flaw poses a significant risk to organizations using Gogs for version control, as malicious actors could potentially gain full control over affected systems. Currently, there are no patches available to fix this issue, leaving users vulnerable until a solution is released. The exploitation of this vulnerability is particularly concerning because it can lead to data breaches or further attacks within an organization's infrastructure. Users and administrators of Gogs should take immediate action to secure their installations and monitor for any unusual activity.

May 28, 2026

When old data brings AI rollouts to a screeching halt - and how to manage it

Romanian gets 5 years in prison for hacking Oregon govt network

BleepingComputer

A Romanian man was sentenced to 56 months in federal prison for hacking into a computer network used by the Oregon state government. This incident was part of a broader series of cyberattacks that targeted multiple victims across the United States. The hacker's activities included unauthorized access to sensitive governmental information, which raises concerns about the security of public sector networks. Such breaches can compromise not only data integrity but also the trust of citizens in their government. The case serves as a reminder of the ongoing risks posed by cybercriminals, particularly those operating from abroad.

May 28, 2026