VulnHub

The UK government has imposed sanctions on several Russian and Chinese firms believed to be involved in information warfare. This move comes as part of a broader effort to counteract hybrid threats that aim to undermine national infrastructure and disrupt democratic processes. The sanctions target entities suspected of using misinformation tactics and other malign activities to influence public opinion and destabilize the UK and its allies. This action reflects growing concerns about the use of technology in geopolitical conflicts and the importance of protecting democratic institutions from foreign interference. The implications of these sanctions could extend beyond immediate economic impacts, as they signal a commitment to addressing the risks posed by hostile state actors.

Japanese companies, including manufacturers and retailers, have fallen victim to a series of ransomware attacks that have severely disrupted their operations. These incidents have affected not only private businesses but also government entities, leading to prolonged recovery times that can stretch over several months. The attackers are leveraging vulnerabilities in systems to encrypt critical data, causing significant financial and operational losses. As organizations struggle to restore services and secure their networks, the situation raises concerns about the overall cybersecurity posture in Japan. This trend highlights the need for improved defenses against ransomware, especially for sectors that are vital to the economy.

North Korea-linked cyber actors are exploiting a recently identified vulnerability in React Server Components known as React2Shell to deploy a new remote access trojan called EtherRAT. This malware utilizes Ethereum smart contracts to manage command-and-control communications and can establish multiple persistence mechanisms on Linux systems. The emergence of EtherRAT marks a concerning development as it allows attackers to maintain access to compromised systems. Companies using React Server Components need to be vigilant and update their systems to mitigate this risk. The situation emphasizes the ongoing threat posed by state-sponsored hacking groups and the importance of timely patching of known vulnerabilities.

Ivanti has issued a warning to customers regarding a serious vulnerability in its Endpoint Manager (EPM) software that could allow remote code execution by attackers. This flaw could potentially enable unauthorized access to systems managed by EPM, posing a significant risk to organizations using the software. Users are urged to apply patches as soon as possible to protect their systems from potential exploitation. The vulnerability affects various versions of Ivanti's Endpoint Manager, making it crucial for affected organizations to act quickly. Failure to address this issue could lead to severe security breaches, including data theft and system compromise.

The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and international partners, is warning about potential cyber threats from pro-Russia hacktivist groups. These groups are targeting critical infrastructure sectors, which could lead to significant disruptions in services and operations. The alert emphasizes the need for organizations to strengthen their cybersecurity measures and remain vigilant against possible attacks. This warning comes amid ongoing geopolitical tensions, making it crucial for sectors like energy, transportation, and healthcare to assess their security posture. Companies are encouraged to implement best practices to defend against these threats, ensuring that they are prepared for any potential disruptions.

On December 2025 Patch Tuesday, a total of 57 Common Vulnerabilities and Exposures (CVEs) were reported, including one critical zero-day vulnerability and two others that have been publicly disclosed. The zero-day is particularly concerning as it is actively exploited, meaning attackers may already be using it to compromise systems. Users and organizations running affected software should prioritize applying the latest patches to mitigate these risks. The vulnerabilities impact various products and systems, highlighting the ongoing need for vigilance in cybersecurity practices. Keeping software updated is essential to defend against potential exploitation.

A data breach at Marquis Software Solutions has compromised the personal information of over 780,000 individuals across the United States due to a firewall vulnerability. This incident highlights the critical need for robust cybersecurity measures to protect sensitive data from exploitation.

The article discusses a dual campaign targeting GlobalProtect portals and SonicWall APIs, highlighting a critical XXE vulnerability found in Apache software. This vulnerability poses a significant risk, necessitating immediate attention from affected organizations to mitigate potential exploitation.

A critical security vulnerability, CVE-2025-66516, has been identified in Apache Tika, posing a risk of XML external entity (XXE) injection attacks. With a CVSS score of 10.0, this flaw affects multiple modules and requires urgent attention from users to prevent exploitation.

A critical vulnerability in the React JavaScript library is currently being targeted by threat actors linked to China, highlighting the urgency for developers to implement patches. The situation underscores the importance of immediate action to secure applications using this library from potential exploitation.

The article discusses a critical vulnerability in React that has been exploited by various threat actors, leading to a significant outage at Cloudflare as they implemented mitigations against the React2Shell exploit. This incident highlights the ongoing risks associated with vulnerabilities in widely used frameworks and the need for timely responses to emerging threats.

Cloudflare has reported an outage due to the emergency patching of a critical React remote code execution vulnerability that is currently being exploited in attacks. This incident highlights the urgency and severity of addressing such vulnerabilities to maintain security and service continuity.

The article discusses newly published guidance from global cybersecurity agencies on the safe deployment of artificial intelligence in operational technology (OT), which is essential for critical infrastructure. This guidance aims to address potential security risks associated with AI in OT environments.

Cybersecurity agencies have released guidance aimed at ensuring the secure integration of artificial intelligence into operational technology (OT) systems. This guidance highlights the importance of addressing potential vulnerabilities and threats associated with AI in critical infrastructure.

Cloudflare's Q3 2025 DDoS Threat Report highlights the unprecedented scale of a DDoS attack launched by the Aisuru botnet, reaching 29.7 Tbps. This surge in attacks indicates a growing threat landscape, particularly affecting critical sectors and emphasizing the need for enhanced cybersecurity measures.