Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
Published: 2025-12-03
A maximum-severity security flaw (CVE-2025-55182, CVSS 10.0) in React Server Components enables unauthenticated remote code execution by exploiting unsafe payload decoding in React Server Function endpoints. The vulnerability impacts versions 19.0 and 19.1.0, and can affect apps even without Server Function endpoints if they support Server Components.
2. Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation
Published: 2025-12-03
Microsoft patched CVE-2025-9491 (CVSS 7.8/7.0) in November 2025 updates, a Windows Shortcut (LNK) file vulnerability exploited since 2017 that allows remote code execution by hiding malicious content in file properties.
3. Critical King Addons Vulnerability Exploited to Hack WordPress Sites
Published: 2025-12-03
A critical-severity vulnerability in the King Addons for Elementor plugin for WordPress has been exploited to take over websites.
4. Android Zero-Days Patched in December 2025 Security Update
Published: 2025-12-02
Google warns that two out of the 107 vulnerabilities patched in Android this month have been exploited in limited, targeted attacks.
5. Korea Arrests Suspects Selling Intimate Videos From Hacked IP Cameras
Published: 2025-12-02
The Korean National Police have arrested four individuals suspected of hacking over 120,000 IP cameras across the country and then selling stolen footage to a foreign adult site.
6. Google Fixes Two Android Zero Days Exploited in Attacks, 107 Flaws
Published: 2025-12-02
Google has released the December 2025 Android security bulletin, addressing 107 vulnerabilities, including two flaws actively exploited in targeted attacks.
7. AI Bolsters Python Variant of Brazilian WhatsApp Attacks
Published: 2025-12-03
Water Saci has upgraded its self-propagating malware to compromise banks and cryptocurrency exchanges by targeting enterprise users of the popular chat app.
8. ‘ShadyPanda’ Hackers Weaponize Millions of Browsers
Published: 2025-12-03
Hackers known as ‘ShadyPanda’ are weaponizing millions of browsers to conduct cyberattacks.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using tools like vulnerability scanners and multi-factor authentication to enhance your security posture. Stay safe online!