VulnHub

Senator Maria Cantwell from Washington is pushing for hearings to investigate how AT&T and Verizon have responded to recent cyberattacks targeting telecom networks. She claims that these companies have obstructed the release of a report known as Salt Typhoon, which likely contains critical information about the hacks. Cantwell's calls for transparency come amid growing concerns about the security of telecommunication infrastructure, especially as it plays a vital role in national security and everyday communications. The outcome of these hearings could lead to increased accountability for telecom companies in how they protect their networks and respond to breaches.

Nick Andersen, a senior official at the Cybersecurity and Infrastructure Security Agency (CISA), recently outlined plans to enhance the Critical Infrastructure Partnership Advisory Council (CIPAC) and establish an Artificial Intelligence Information Sharing and Analysis Center (AI-ISAC). These initiatives aim to improve collaboration among government agencies and private sector organizations to better protect critical infrastructure. The focus on AI in cybersecurity reflects growing concerns about the potential risks and vulnerabilities associated with emerging technologies. The establishment of the AI-ISAC would facilitate the sharing of information related to AI threats, helping organizations stay ahead of potential cyber attacks. This move is significant as it underscores the need for updated frameworks to address the evolving landscape of cybersecurity challenges.

Ivanti's Endpoint Manager Mobile (EPMM) is currently facing serious security threats due to two newly discovered zero-day vulnerabilities. Initial limited attacks were reported before Ivanti made its findings public, but since then, numerous threat groups have exploited these weaknesses, leading to a surge in attacks. More than 1,400 instances of EPMM remain exposed, putting organizations at risk of unauthorized access and data breaches. This situation is alarming as it highlights the vulnerabilities in widely used software, prompting urgent action from affected users to protect their systems. Companies using EPMM should prioritize patching and securing their environments to mitigate the risks associated with these vulnerabilities.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability in SolarWinds Web Help Desk that is currently being exploited in active attacks. This flaw poses a risk to federal agencies, which have been instructed to apply necessary patches within three days to mitigate potential damage. The urgency of the situation underscores the importance of maintaining up-to-date systems, especially for organizations that rely on SolarWinds products. If left unaddressed, this vulnerability could lead to unauthorized access and compromise sensitive data, affecting not just government agencies but potentially their partners and clients as well. The situation is a reminder for all users of SolarWinds software to remain vigilant and ensure their systems are secure.

Hackers have been exploiting a serious vulnerability in the React Native CLI, identified as CVE-2025-11953, to execute remote commands and deploy stealthy Rust-based malware. This flaw arises from the React Native CLI's Metro server, which, by default, binds to external interfaces, making it susceptible to unauthorized access. This exploitation occurred weeks before the vulnerability was publicly disclosed, indicating that attackers are actively targeting this weakness. Users of React Native should be particularly vigilant, as the impact could extend to various applications built on this framework. Prompt action is necessary to secure affected systems and prevent further malicious activities.

A newly discovered vulnerability in React Native has been exploited in the wild, allowing attackers to disable security protections and deliver malware to affected devices. This flaw, which was previously thought to be a theoretical risk, has now raised alarms among developers and users of applications built with React Native. The impact of this vulnerability can be significant, as it compromises the integrity and security of applications, potentially affecting millions of users. Developers are urged to take immediate action to secure their applications and protect user data from malicious exploitation.

A serious security vulnerability, identified as CVE-2025-11953 and nicknamed Metro4Shell, has been discovered in the Metro Development Server, which is part of the '@react-native-community/cli' npm package. This flaw, rated 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication. Researchers from VulnCheck first detected active exploitation of this vulnerability on December 21, 2025. This poses a significant risk for developers and organizations using this package, as it could lead to unauthorized control over their systems. Users of the affected npm package need to take immediate action to protect their applications.

The manufacturing industry in the U.S. is facing increasing cybersecurity threats, particularly from intensified cyberattacks believed to be originating from China. In response to these growing risks, manufacturing firms are coming together to strengthen their cybersecurity efforts through the Manufacturing Information Sharing and Analysis Center (ISAC). This collaboration aims to enhance the sharing of information about potential threats and vulnerabilities among companies within the sector. As critical infrastructure becomes more targeted by malicious actors, these partnerships are essential for protecting sensitive data and ensuring operational continuity. The move reflects a recognition that collective defense strategies are crucial in combating sophisticated cyber threats.

Tulsa International Airport has reportedly been compromised by the Qilin ransomware group, which claims to have stolen more than a dozen files from the airport's internal systems. This incident raises concerns about the security of critical infrastructure, as airports handle sensitive data and operations that are vital for public safety and travel. The breach could potentially disrupt airport operations or expose personal information of employees and travelers. As ransomware attacks continue to target essential services, this incident serves as a reminder for organizations to bolster their cybersecurity measures against increasing threats from cybercriminals. The situation is still developing, and further details regarding the extent of the breach and its implications are awaited.

Iranian hackers have utilized artificial intelligence to carry out cyberattacks targeting individuals and organizations that have reported on human rights abuses amid ongoing protests in the country. This campaign, known as RedKitten, aims to intimidate and silence voices critical of the Iranian government. The use of large language models in these attacks indicates a shift in tactics, as attackers look to enhance their capabilities in spreading misinformation and conducting surveillance. Those affected include non-governmental organizations, activists, and journalists who are documenting the protests and human rights violations. This development raises significant concerns about the intersection of technology and state-sponsored aggression, particularly in how it can stifle dissent and manipulate narratives during critical social movements.

As federal agencies like the Cybersecurity and Infrastructure Security Agency (CISA) scale back their support for election security, state officials are feeling the pressure to fill the gap. Secretaries of State across the country are now seeking alternative cybersecurity services to protect their election systems. This shift comes at a time when many states are still working to bolster their defenses following past election interference incidents. The lack of federal resources means states will need to rely more on their own budgets and local expertise, which could lead to disparities in security measures across the nation. Ensuring safe and secure elections is critical for maintaining public trust in the electoral process.

The National Security Agency (NSA) has released new guidelines aimed at helping organizations implement Zero Trust security models effectively. This approach focuses on minimizing trust assumptions within networks, requiring strict verification for every user and device attempting to access resources. The guidelines are designed for organizations looking to reach a target-level maturity in their Zero Trust practices, which is increasingly important as cyber threats evolve. By adopting these recommendations, companies can better protect their sensitive data and systems from unauthorized access. This is particularly relevant for sectors handling critical infrastructure or sensitive information.

Ivanti has reported two serious vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340. These flaws allow remote code execution, meaning attackers could potentially take control of affected systems without needing physical access. The company warns that these vulnerabilities are currently being actively exploited, putting users at risk. Organizations using EPMM should prioritize applying the necessary security updates to safeguard their systems. Failure to address these vulnerabilities could lead to significant security breaches, affecting both the integrity of user data and the overall security posture of the organization.

Poland's Computer Emergency Response Team (CERT) has reported a serious cyberattack on the country's energy facilities. The attack involved the exploitation of default credentials in industrial control systems (ICS), which allowed attackers to gain unauthorized access and cause significant disruptions. This incident raises concerns about the security of critical infrastructure, particularly as it highlights the risks associated with using default login information. The targeted energy facilities are crucial for Poland's power supply, and any breach in their security can have widespread implications for both the economy and public safety. The report also suggests that this attack may be part of a broader trend of cyber threats aimed at critical infrastructure worldwide.

Japan and Britain are stepping up their collaboration on cybersecurity and the supply of critical minerals in response to growing concerns over China's influence in the region. This partnership aims to enhance both countries' resilience against potential cyber threats and secure essential resources that are vital for technology and defense sectors. The agreement comes amid increasing geopolitical tensions and highlights the need for nations to work together to protect their infrastructure and supply chains. By sharing expertise and resources, Japan and Britain aim to bolster their defenses and ensure a stable supply of critical minerals, which are crucial for various industries, including electronics and renewable energy.