Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks
Published: 2025-12-13
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity unrestricted file upload vulnerability (CVE-2018-4063) in Sierra Wireless AirLink ALEOS routers to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild, allowing remote code execution via malicious HTTP requests.
2. Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild
Published: 2025-12-13
Apple released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to patch two WebKit vulnerabilities (CVE-2025-43529 and CVE-2025-14174) exploited in the wild, including a use-after-free issue leading to arbitrary code execution and a memory corruption flaw.
3. Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads
Published: 2025-12-12
Cybersecurity researchers reported a campaign using GitHub-hosted Python repositories themed as OSINT tools or GPT utilities to distribute PyStoreRAT, a JavaScript-based Remote Access Trojan (RAT) that downloads and executes remote HTA files via mshta.exe.
4. New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale
Published: 2025-12-12
Researchers documented four phishing kits—BlackForce, GhostFrame, InboxPrime AI, and Spiderman—capable of large-scale credential theft, with BlackForce enabling Man-in-the-Browser attacks to capture OTPs and bypass MFA while impersonating brands like Disney and Netflix.
5. New React RSC Vulnerabilities Enable DoS and Source Code Exposure
Published: 2025-12-12
The React team patched two new flaws in React Server Components (RSC), CVE-2025-55184 and CVE-2025-67779, causing denial-of-service via unsafe deserialization leading to infinite loops, and CVE-2025-55183, enabling information leaks through crafted HTTP requests.
6. React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation
Published: 2025-12-12
CISA urged federal agencies to patch CVE-2025-55182, a critical React Server Components (RSC) Flight protocol vulnerability with a CVSS score of 10.0, enabling unauthenticated remote code execution via unsafe deserialization after its disclosure on December 3, 2025.
7. CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog
Published: 2025-12-12
CISA added CVE-2025-58360, an unauthenticated XML External Entity (XXE) vulnerability in OSGeo GeoServer (CVSS score: 8.2), to its KEV catalog due to active exploitation, affecting versions prior to 2.25.5 and specific 2.26 releases.
8. Gladinet CentreStack Flaw Exploited to Hack Organizations
Published: 2025-12-12
Threat actors have hacked at least nine organizations by exploiting the recently patched Gladinet CentreStack flaw.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using tools like vulnerability scanners to monitor your systems for exploits and automate security patches. Stay safe online!