Amid Rising Threats, NATO Holds Its Largest-ever Cyberdefense Exercise

NATO conducted its largest cyberdefense exercise, Cyber Coalition, in Estonia, involving 1,300 participants from 29 allies and 7 partner nations. The exercise aimed to simulate responses to multi-faceted cyber threats against critical infrastructure and emphasized cooperation over competition. Participants addressed complex scenarios, verifying threats and collaborating on intelligence sharing. A new space-based scenario was introduced, reflecting real-world incidents. The exercise highlighted the necessity of sharing information to tackle modern cyber challenges effectively.

https://therecord.media/nato-holds-largest-ever-cyberdefense-exercise-estonia

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

Critical security flaw in React Server Components (CVE-2025-55182) allows unauthenticated remote code execution, affecting multiple React versions. Exploitable due to unsafe deserialization, attackers can craft HTTP requests to execute arbitrary JavaScript. This impacts versions of React libraries and Next.js. Patches are available; users advised to update and monitor for suspicious traffic until then. Various cloud providers have implemented protective measures.

https://thehackernews.com/2025/12/critical-rsc-bugs-in-react-and-nextjs.html

Microsoft “mitigates” Windows LNK Flaw Exploited as Zero-day

,

Microsoft mitigated a severe Windows LNK vulnerability exploited by state and cybercrime groups (CVE-2025-9491), allowing attackers to conceal malicious operations in LNK files, requiring user interaction to execute. Despite initial inaction, Microsoft silently adjusted LNK file visibility in June 2025, while unofficial patches have been offered to limit risks until a thorough fix is provided.

https://www.bleepingcomputer.com/news/microsoft/microsoft-mitigates-windows-lnk-flaw-exploited-as-zero-day/

How Attackers Use Real IT Tools to Take Over Your Computer

Attackers are exploiting legitimate Remote Monitoring and Management (RMM) tools, like LogMeIn Resolve, to gain remote access to victims’ computers without traditional malware. By disguising these tools as common software, they evade security measures. Users are advised to download software from official sources, verify file signatures, and stay informed about social engineering tactics.

https://www.malwarebytes.com/blog/news/2025/12/how-attackers-use-real-it-tools-to-take-over-your-computer

India Backs Off Mandatory ‘cyber Safety’ App After Surveillance Backlash

,

India cancels mandatory “cyber safety” app installation for new smartphones after privacy concerns arose. The government initially required device makers to preload the app, but backlash led to its reversal. Officials claimed the app aimed to combat fraud and theft, emphasizing user security and the ability to uninstall it. Digital rights advocates welcomed the decision but remained cautious until formal legal confirmation.

https://therecord.media/india-drops-mandate-sanchar-saathi-app-privacy-surveillance

Critical Vulnerability in React and Next.js (CVE-2025-55182)

TLDR: On December 3, 2025, React disclosed CVE-2025-55182, a critical remote code execution vulnerability (CVSS 10) in React Server Components due to unsafe deserialization. Affects React versions 19.0-19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1. Next.js versions 15.0.5-15.5.7 and 16.0.7 also need updates. Vulnerability allows remote exploitation without authentication.

https://www.vulncheck.com/blog/cve-2025-55182-react-nextjs

AI Malware: Hype Vs. Reality

,

AI Malware currently operates at low maturity levels (AIM3 Levels 1-3), mainly assisting existing attack methods rather than enabling fully autonomous threats. Claims of advanced AI malware often stem from limited research demos with unclear impacts. No confirmed instances of fully embedded AI malware exist; most rely on external models. Defenders should focus on monitoring legitimate AI service abuse and strengthening existing controls, rather than reacting to exaggerated scenarios of AI threats.

https://www.recordedfuture.com/blog/ai-malware-hype-vs-reality

India Demands Smartphone Makers Install Government App

,

India mandates all smartphone makers to pre-install the “Sanchar Saathi” app on devices within 90 days to combat fraud and enhance telecom security. The app allows users to report suspected fraud, block stolen devices, and verify IMEI numbers. Critics raise concerns about privacy, as the app accesses call logs and messages, while some users welcome it as a fraud-fighting tool.

https://www.theregister.com/2025/12/02/india_mandatory_sanchar_saathi_app/

Google Fixes Two Android Zero Days Exploited in Attacks, 107 Flaws

, ,

Google’s December 2025 Android security update fixes 107 vulnerabilities, including two exploited in attacks. Major issues address information disclosure and elevation of privileges. Critical flaws also include a denial-of-service vulnerability in the Android Framework and several severe vulnerabilities in the Kernel affecting Qualcomm devices. Users should update to newer Android versions or use third-party distributions for security.

https://www.bleepingcomputer.com/news/security/google-fixes-two-android-zero-days-exploited-in-attacks-107-flaws/

OpenAI Codex CLI Vulnerability: Command Injection

, ,

CVE-2025-61260 – OpenAI Codex CLI Command Injection Vulnerability:
OpenAI Codex CLI is susceptible to command injection via project-local configurations, enabling attackers to execute arbitrary commands on developer machines without user consent. By manipulating .env and config.toml files, an attacker can leverage the automatic loading of MCP server entries to create a backdoor, allowing persistent remote access and command execution. This vulnerability compromises developer workflows and can propagate through supply chains. A fix was issued in version 0.23.0, blocking the unsafe redirection of configuration paths. Users are advised to update immediately.

https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/

4.3 Million Browsers Infected: Inside ShadyPanda’s 7-Year Malware Campaign

,

4.3M Browsers Infected by ShadyPanda Malware: A seven-year campaign leveraged malicious browser extensions infecting 4.3 million Chrome and Edge users. ShadyPanda employed a phased strategy, transitioning from affiliate fraud to spyware. Initially, they disguised malicious extensions as legitimate tools, then progressively escalated operations to include remote code execution and comprehensive data surveillance. The extensions, some Google-verified, captured and exfiltrated extensive user data, exploiting marketplace oversight flaws. Despite termination of some extensions, others remain active with significant surveillance capabilities, highlighting systemic security vulnerabilities in extension marketplaces.

https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign

New Android Malware Lets Criminals Control Your Phone and Drain Your Bank Account

, ,

New Android malware, Albiriox, allows attackers remote control of infected phones to siphon money from bank and crypto accounts. It operates as Malware-as-a-Service (MaaS), targeting over 400 financial apps globally. Albiriox employs advanced techniques like live streaming, automated clicks, and stealth operations to evade detection, making it a significant threat. Users should only install trusted apps, verify permissions, and utilize up-to-date anti-malware solutions for protection.

https://www.malwarebytes.com/blog/news/2025/12/new-android-malware-lets-criminals-control-your-phone-and-drain-your-bank-account

Dutch Study Finds Teen Cybercrime Is Mostly Just a Phase

Dutch study reveals teen cybercrime is largely temporary; offenders mature by 20, with few continuing. Most youngsters dabble in cybercrime, similar to other offenses. Peak offending age is 20, but few persist beyond that due to curiosity about tech, not monetary gain. Annual social cost of adolescent crime in the Netherlands is €10.3 billion, with costs of cybercrime challenging to quantify. Longitudinal research on cybercrime remains limited, impacting accurate cost assessments.

https://www.theregister.com/2025/12/01/dutch_study_teen_cybercrime/

Scroll to Top