VulnHub

A recent phishing campaign has targeted around 6,000 companies, sending over 40,000 fraudulent emails that appeared to come from trusted services like SharePoint and DocuSign. These emails contained malicious links disguised by reputable redirect services, making it easier for scammers to trick recipients into clicking. The scale and speed of this attack raise concerns about the vulnerability of businesses to such tactics, which exploit the trust users place in well-known platforms. Companies need to be vigilant, as these phishing attempts can lead to data breaches or financial loss if employees fall for the scams. Ensuring proper training and awareness around phishing tactics is crucial for organizations to protect themselves.

Cybersecurity experts are reporting a surge in malware attacks exploiting a serious vulnerability in the React library, known as React2Shell. This vulnerability allows attackers to execute code remotely without authentication, putting many applications at risk. React is widely used for building user interfaces, meaning a broad range of developers and companies could be affected. The situation is concerning as it opens the door for various types of malware to be deployed against unsuspecting users. Companies using React should take immediate action to assess their systems and implement security measures to protect against these attacks.

A serious security vulnerability in Gogs, a self-hosted Git service, is currently being exploited, affecting over 700 instances worldwide. This flaw, identified as CVE-2025-8110, has a CVSS score of 8.7 and allows attackers to overwrite files via the file update API. The lack of a patch means that many users are at risk, and researchers from Wiz have highlighted the urgency of addressing this issue. Companies using Gogs should take immediate action to secure their installations and monitor for any signs of compromise. The situation underscores the need for timely updates and vigilance in managing self-hosted services.

Google has addressed a zero-day vulnerability in its Chrome browser that was actively exploited in the wild. This vulnerability, which does not have a CVE identifier, remains shrouded in mystery, as details about its origin and the specific components it affects are unclear. The lack of a CVE means users and security experts have limited information regarding the potential risks involved. However, the fact that it has been exploited means users should update their Chrome browsers promptly to safeguard against potential attacks. Keeping software up to date is crucial in mitigating risks associated with such vulnerabilities.

CVE-2025-55182 is currently being exploited by threat actors, raising concerns about the potential for increased attacks. This vulnerability affects a range of systems, and researchers have noted that their honeypots are already being targeted. In addition to the exploitation, specific malware has been identified as part of these attacks, which could compromise the integrity of affected systems. It’s crucial for organizations to understand the implications of this vulnerability and take proactive measures to protect their infrastructure. Knowing how to defend against this threat is vital as the situation evolves.

Researchers have identified a significant surge in attacks linked to a vulnerability in React2Shell, with more than 50 confirmed victims to date. This issue stems from a critical defect that has left many systems exposed, as reports indicate that about half of these vulnerable instances remain unpatched. The rapid exploitation of this flaw underscores the urgency for affected organizations to take immediate action to secure their systems. Companies using React2Shell need to prioritize updates and patch deployments to mitigate these risks. Failure to address this vulnerability could lead to more widespread damage and data breaches as attackers continue to exploit the flaw in the wild.

The FBI has issued a warning about a new scam involving fake kidnapping threats that utilize AI-generated images. Scammers contact victims via text, claiming to have abducted a loved one and demanding ransom for their release. To make their threats more convincing, they often send images or videos of the supposed victim, which may look real at first glance but often contain discrepancies, such as missing tattoos or wrong body proportions. These criminals may use timed messages to pressure victims into paying quickly, reducing the chance for them to scrutinize the evidence. This type of scam not only preys on the emotional vulnerability of individuals but also highlights the growing misuse of technology in criminal activities, making it essential for people to stay vigilant and verify claims before taking action.

North Korea-linked cyber actors are exploiting a recently identified vulnerability in React Server Components known as React2Shell to deploy a new remote access trojan called EtherRAT. This malware utilizes Ethereum smart contracts to manage command-and-control communications and can establish multiple persistence mechanisms on Linux systems. The emergence of EtherRAT marks a concerning development as it allows attackers to maintain access to compromised systems. Companies using React Server Components need to be vigilant and update their systems to mitigate this risk. The situation emphasizes the ongoing threat posed by state-sponsored hacking groups and the importance of timely patching of known vulnerabilities.

Sysdig has identified a series of advanced cyberattacks exploiting a vulnerability known as React2Shell, which has been linked to North Korean hacker groups. These campaigns are distributing a type of malware called EtherRAT, which allows attackers to take control of compromised systems. This situation poses a significant risk to organizations that may be using affected systems, as it could lead to unauthorized access to sensitive data and networks. The involvement of North Korean actors suggests that these attacks might be part of a broader strategy to target specific industries or organizations. Companies should be vigilant and ensure their systems are secured against this type of exploitation.

On December 2025 Patch Tuesday, a total of 57 Common Vulnerabilities and Exposures (CVEs) were reported, including one critical zero-day vulnerability and two others that have been publicly disclosed. The zero-day is particularly concerning as it is actively exploited, meaning attackers may already be using it to compromise systems. Users and organizations running affected software should prioritize applying the latest patches to mitigate these risks. The vulnerabilities impact various products and systems, highlighting the ongoing need for vigilance in cybersecurity practices. Keeping software updated is essential to defend against potential exploitation.