VulnHub

Amazon has alerted users that Sandworm, a group associated with Russia's military intelligence, has changed its approach to cyberattacks. Instead of exploiting software vulnerabilities, the group is now targeting poorly configured network edge devices to maintain access to their targets. This shift raises concerns for organizations that may not have secured their network configurations adequately. The focus on these devices suggests attackers are adapting their strategies to exploit weaknesses in network management rather than relying on traditional software flaws. This change could lead to increased risks for various industries, especially those with critical infrastructure that may be vulnerable due to lax network settings.

Fortinet FortiGate devices are currently under active attack due to two recently disclosed vulnerabilities, CVE-2025-59718 and CVE-2025-59719, which allow for authentication bypass through malicious single sign-on (SSO) logins. Cybersecurity firm Arctic Wolf reported observing these attacks on December 12, 2025, just days after the vulnerabilities were made public. This situation poses significant risks for organizations using FortiGate appliances, as attackers can potentially gain unauthorized access to sensitive systems. Companies using these devices should take immediate action to protect their networks and data from these ongoing intrusions.

The React2Shell vulnerability is currently being exploited by cybercriminals to install malware on Linux systems. Researchers from Palo Alto Networks and NTT Security have identified that this vulnerability facilitates the deployment of malicious tools like KSwapDoor and ZnDoor. KSwapDoor is particularly concerning as it is a sophisticated remote access tool designed to operate stealthily, allowing attackers to maintain control over compromised systems without detection. This ongoing threat affects organizations running vulnerable Linux environments, making it crucial for them to take immediate action to secure their systems. Users need to be aware of the risks and ensure their defenses are updated to mitigate potential attacks.

A new version of the VolkLocker ransomware, operated by the pro-Russia group CyberVolk, has emerged with notable enhancements but also a significant vulnerability. Researchers discovered that the latest iteration allows victims to decrypt their own files without having to pay a ransom. This flaw undermines the effectiveness of the ransomware, potentially reducing the financial incentive for the attackers. Organizations targeted by this ransomware may find some relief, as they can regain access to their files independently. However, the situation remains concerning as the group continues to evolve its tactics. The presence of such vulnerabilities raises questions about the security measures businesses have in place against ransomware attacks.

Google's threat intelligence team has identified five additional Chinese hacking groups involved in exploiting the React2Shell vulnerability, which allows for remote code execution. This vulnerability is considered highly severe, making it a significant risk for affected systems. The groups are believed to be using this exploit to target various organizations, potentially compromising sensitive data and disrupting operations. The identification of these groups emphasizes the ongoing threat posed by state-sponsored hackers and the need for organizations to bolster their defenses against such attacks. Companies that utilize affected software should take immediate action to mitigate risks associated with this vulnerability.

Apple has released security updates to address two vulnerabilities in WebKit, identified as CVE-2025-14174 and CVE-2025-43529, which are currently being exploited in the wild. The first vulnerability, CVE-2025-14174, was previously patched by Google for its Chrome desktop browser, but details were limited at that time. This flaw allows for out-of-bounds memory access, potentially enabling attackers to execute arbitrary code. Users of Apple devices, particularly those running Safari or any applications reliant on WebKit, should prioritize updating their systems to safeguard against these vulnerabilities. Ignoring these updates could leave devices exposed to active exploitation.

In December 2025, researchers identified a serious vulnerability in React, designated as CVE-2025-55182, which has led to a surge in attacks on services that use React2Shell. This vulnerability affects numerous applications built with the React framework, making them targets for malicious actors. Attackers are exploiting this flaw to gain unauthorized access to systems, which could lead to data breaches or service disruptions. Organizations utilizing React-enabled services are urged to take immediate action to safeguard their systems. The situation is critical, as the exploitation of this vulnerability poses significant risks to businesses and users globally.

A vulnerability in GeoServer has been identified, allowing attackers to exploit insufficient sanitization of user input. This flaw enables them to define external entities within XML requests, potentially leading to unauthorized access or data exposure. Organizations using GeoServer should take this threat seriously, as it could compromise the integrity of their data and systems. It's crucial for users to implement adequate security measures to mitigate this risk. As this vulnerability is being actively exploited, immediate action is necessary to protect sensitive information and maintain system security.

A new zero-day vulnerability has been discovered in Windows that affects the Remote Access Connection Manager (RasMan) service, allowing attackers to crash it. This flaw could disrupt remote access services for users and organizations relying on Windows systems. Unofficial patches have been made available for users who want to mitigate the risk before an official fix is released. As this vulnerability is a zero-day, it is crucial for affected users to apply these patches promptly to avoid potential exploitation. The issue underscores the need for vigilance in maintaining system security, especially for those using Windows.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for U.S. federal agencies to patch a serious vulnerability found in GeoServer. This flaw is being exploited in XML External Entity (XXE) injection attacks, which can allow attackers to access sensitive data. The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of systems using GeoServer. Agencies are advised to take immediate action to defend against potential breaches and secure their data. Given that this vulnerability is actively being exploited, it is crucial for affected organizations to prioritize the necessary updates to protect their networks from compromise.