Try THIS Prompt to Build a CRUD Note Taking App!
Try THIS Prompt to Build a CRUD Note Taking App!
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
MongoBleed (CVE-2025-14847): How to Fix the Critical MongoDB Memory Leak
CVE-2025-14847, nicknamed MongoBleed, is a high-severity (CVSS 7.5–8.7) unauthenticated information disclosure vulnerability in MongoDB Server. It allows remote attackers to leak uninitialized heap memory containing sensitive data—such as credentials, API keys, session tokens, and PII—without authentication. Exploitation occurs pre-authentication via malformed zlib-compressed network packets on port 27017.
Jon Oltsik: Shifting Left and Threat Informed Defense
Security researcher and analyst Jon Oltsik talks about the importance of shifting lift and employing threat informed defense in this short clip.
Zero-day vulnerabilities: what they are and how to respond
Zero-day vulnerabilities often attract attention and concern because of their unpredictability. They are, by definition, weaknesses that are unknown to software vendors and therefore have no official fix at the point of discovery. When discovered and exploited by malicious actors, they allow attackers to bypass controls before organisations even realise there is a problem.
A New Model You Haven't Heard About (GitHub Raptor Mini)
Can an under-the-radar AI tool actually build a secure, functional CRUD note-taking app from scratch? In this video, I put GitHub Raptor Mini to the test to see if it can design, implement, and reason through a real-world CRUD application — including authentication, data handling, and basic security considerations.
CVE-2025-14847: MongoBleed Information Disclosure Vulnerability Exploited in the Wild
On December 19, 2025, MongoDB issued an advisory for CVE-2025-14847, known as “MongoBleed,” a high-severity vulnerability in the server’s zlib-based network compression functionality. This vulnerability affects how the database handles compressed network communications and can cause it to accidentally leak sensitive information from its memory when abused by unauthenticated threat actors. The problem occurs when MongoDB receives a specially crafted message.
MongoBleed (CVE-2025-14847): Critical Unauthenticated MongoDB Memory Disclosure
A critical vulnerability identified as CVE-2025-14847 (dubbed “MongoBleed“) affects MongoDB Server instances, exposing systems to unauthenticated information disclosure. This vulnerability allows a remote attacker to read sensitive data from the server’s memory without requiring authentication.
Security Alert: CVE-2025-14847 MongoDB "MongoBleed" Actively Exploited
A high-severity vulnerability, CVE-2025-14847, affecting MongoDB Server is being actively exploited in the wild with a Bitsight Dynamic Vulnerability Exploit (DVE) score of 9.71. The flaw, commonly referred to as “MongoBleed,” is an unauthenticated memory-read vulnerability caused by improper handling of zlib-compressed network message headers, which may allow attackers to read uninitialized heap memory remotely.
The Holiday Whisper: Shai-Hulud 3.0
The end-of-year holiday period is traditionally a time for code freezes and quiet rotations; however, it is also a favored window for opportunistic attackers. Threat actors love the holidays; they know that with development teams out of the office and response times naturally lagging, a small window opens for them to test new exploits without immediate detection. Recently, a security researcher discovered a new, contained variant of Shai-Hulud, dubbed "The Golden Path" (v3.0).
Emerging Threat: CVE-2025-14733 - Authentication Bypass Vulnerability
CVE-2025-14733 is a high-severity authentication bypass vulnerability affecting a widely deployed enterprise web application platform used to manage administrative and API access. The flaw allows attackers to bypass authentication controls under specific conditions by manipulating request parameters and session handling logic.
MongoBleed (CVE-2025-14847): Unauthenticated Memory Disclosure in MongoDB
A newly disclosed MongoDB vulnerability, tracked as CVE-2025-14847 and informally referred to as MongoBleed, allows unauthenticated remote attackers to leak uninitialized memory from a MongoDB server. A public proof-of-concept exploit is already available, significantly increasing the risk for exposed MongoDB deployments. This post explains how the vulnerability works, what is required to exploit it, and how ARMO helps identify exposure and detect exploitation attempts at runtime.
MongoBleed: Inside CVE-2025-14847 & How to Secure Your Infrastructure
In the world of database security, few things are as alarming as an unauthenticated memory leak. It recalls the panic of OpenSSL’s Heartbleed - a vulnerability where a simple heartbeat request could bleed out sensitive secrets from a server's memory. Now, MongoDB users are facing their own version: CVE-2025-14847, widely dubbed "MongoBleed".
CVE-2025-68613: Critical RCE in n8n via expression injection
In the current AI gold rush, teams are rapidly standing up automation, AI orchestration, and integration platforms to move faster. In many cases, speed comes at the expense of visibility and security. This is where external attack surface management becomes critical. IONIX can identify and continuously monitor a wide range of AI-related and automation assets exposed to the internet, helping organizations understand what they are running, where it is exposed, and what risks it introduces.
CVE-2025-68613: Critical n8n RCE Vulnerability Enables Full Server Compromise
A critical remote code execution (RCE) vulnerability has been disclosed in n8n, a popular open-source workflow automation platform widely used to orchestrate business processes, SaaS integrations, and internal automation pipelines. Tracked as CVE-2025-68613, the vulnerability carries a CVSS score of 9.9 (Critical) and allows authenticated attackers to execute arbitrary system-level code on vulnerable n8n instances.
Remediation Coordination Breaks Down When Assets Have No Owner
Remediation coordination often fails because security teams are dealing with unowned assets and resources. In this hands-on demo, Seemplicity Exposure Management Strategist Rob Babb shows how ownership gaps create blind spots, stall remediation, and slow exposure reduction across teams. The walkthrough highlights how remediation orchestration establishes accountability, improves visibility, and enables automation for exposure remediation across cloud, application, and infrastructure environments.
Apache Commons Text Code Injection Vulnerability (CVE-2025-46295)
A critical code injection vulnerability has been identified in Apache Commons Text, a widely used Java library for text processing and interpolation. Tracked as CVE-2025-46295, the vulnerability carries a CVSS v3 score of 9.8 (Critical) and affects all versions of the library prior to 1.10.0. The vulnerability has an EPSS score of 0.253%, indicating a low short-term probability of exploitation.
Jon Oltsik: Vulnerability Management is a Business Issue
Industry researcher and analyst Jon Oltsik explains why vulnerability management should be considered a business issue and stop being viewed as a technical issue.
How to Add MCP Servers to Google's Antigravity IDE
In this video, I walk you step by step through the process of adding MCP servers to Google’s Antigravity. You’ll learn how they integrate with Antigravity and how to configure them correctly so everything runs smoothly.
From Finding to Fix: Remediation Orchestration When Asset Ownership Is Missing
Security teams don’t struggle to find issues. They struggle to move them forward. In this use case demo, we show how remediation coordination breaks down when assets have no clear owner, and how remediation orchestration restores accountability across teams, tools, and environments. You’ll see how security teams can move beyond manual handoffs, Slack messages, and guesswork by orchestrating remediation across teams, even when ownership is unclear or spans multiple domains.
From Code to Agents: Proactively Securing AI-Native Apps with Cursor and Snyk
The rapid adoption of AI agents for development is creating a critical security gap. We are moving from predictable logic, deterministic code paths, and human-driven workflows to non-deterministic agents that reason, plan, and act autonomously using large language models across the broader software development lifecycle. As enterprises adopt these autonomous AI agents, the core challenge isn’t just the new risks and attack vectors; it’s a loss of runtime control.
Ultimate Guide to Vulnerability Assessment: What, Why & How (2026 Edition)
If you’re an IT MSP, vulnerability assessment has grown from a river to a flood over the last couple of years. In 2020, there were 18,000 recorded common vulnerabilities and exposures (CVEs). By 2024, that number had more than doubled, eclipsing 40,000. And 2025 is showing no signs of reversing the trend. The rise of vulnerabilities means that manual vulnerability assessment is no longer possible.
Critical React2Shell RCE Hits React and Next.js (CVE-2025-55182 / CVE-2025-66478)
React2Shell is a severe remote, unauthenticated RCE vulnerability recently uncovered in React Server Components (RSC) and the Next.js App Router — tracked as CVE-2025-55182, with CVE-2025-66478 later merged as a duplicate — that allows attackers to execute arbitrary code on servers by exploiting insecure Flight protocol deserialization (CWE-502), earning the flaw a maximum CVSS score of 10.0.
Detecting CVE-2025-20393 exploitation: catching UAT-9686 on Cisco appliances
CVE-2025-20393 is a CVSS 10.0 Remote Code Execution (RCE) flaw in Cisco Secure Email Gateways currently being actively exploited by China-nexus groups. A recent advisory from Cisco Talos details how an actor dubbed “UAT-9686” is leveraging this vulnerability to target Cisco Secure Email Gateways (ESA) and Secure Email and Web Managers (SMA). The attack allows threat actors to execute arbitrary commands with root privileges and deploy persistence mechanisms.
CVE-2025-20393: Threat Campaign Targeting Cisco Secure Email Gateway, Cisco Secure Email and Web Manager
On December 17, 2025, Cisco published an advisory detailing a new threat campaign identified on December 10, affecting the Cisco AsyncOS software used on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The campaign is exploiting an unpatched zero-day vulnerability, which only affects deployments with the Spam Quarantine feature enabled. It allows threat actors to execute arbitrary commands with root privileges on affected devices. This feature is not enabled by default.
An Industry Analyst's Take on Nucleus 3.0
In this episode of Nucleus Conversations, industry analyst and researcher Jon Oltsik unpacks the current state of exposure management, why so many organizations still struggle to manage cyber risk at scale, and the impact the recent Nucleus 3.0 releases will have for customers.
Bug bounties and broken CVEs with Bryan Brake
Join us for this week's Defender Fridays as we explore bug bounty programs, vulnerability management, and the complexities of the CVE system with Brian Break, a veteran security professional with twenty years of experience across endpoint security, consulting, and product security. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.
CVE-2025-14733: WatchGuard Firebox iked Out of Bounds Write Vulnerability Exploited in the Wild
On December 18, 2025, WatchGuard released fixes for CVE-2025-14733, a critical out-of-bounds write vulnerability in the Internet Key Exchange daemon (iked) process used to establish VPN tunnels in Fireware OS, which powers Firebox firewall appliances. Exploitation of this vulnerability allows a remote, unauthenticated threat actor to execute arbitrary code. WatchGuard has confirmed in-the-wild exploitation in their advisory.
Zero-Day Vulnerabilities in November 2025
In November 2025, AppTrana detected 227 zero-days and blocked every single one. Explore the full report to see how complete coverage looks.
Lazarus Group (APT38 / APT-C-26) Exploits WinRAR Vulnerability CVE-2025-8088 for Archive Poisoning Attacks
During routine threat research and monitoring of Chinese-language underground distribution channels, our team identified a malicious RAR archive. Specifically, this archive abuses a critical WinRAR directory traversal vulnerability to achieve arbitrary file write and persistence on Windows systems. To accomplish this, the archive leverages a combination of NTFS Alternate Data Streams (ADS) and directory traversal logic.
Looking Ahead to 2026: Why Cyber Economics Will Redefine the CISO's Mandate
Cybersecurity in 2026 will be driven by economics. Not hype. Not novelty. Economics. Attackers follow financial incentives and scale their operations faster than most enterprises can defend. CISOs must shift from reporting technical metrics to explaining business impact, guide safe AI adoption as Shadow AI grows, and design programs that emphasize resilience over perfection.
CVE-2025-55182: First Days of React2Shell Exploitations
On December 3rd Lachlan Davidson disclosed an unauthenticated remote code execution vulnerability in React Server Components (RSC) that exploits how React.js (and Next.js) decodes payloads sent to React Server Function endpoints. On December 4th we started observing fingerprinting attempts for these vulnerabilities and on December 5th we started observing exploitation attempts. React.js is used by 66% of the global digital supply, in the top 0.06% of all technologies.
How PPC Campaign Vulnerabilities Can Lead to Ransomware Attacks
In the US, search ad spend was expected to reach $124.59 billion in 2024. Those big pay-per-click (PPC) advertising budgets are attracting the attention of cybercriminals. Click fraud is a well-known hazard in marketing circles. However, a more insidious threat lurks in the background.
Digital Signage Security: The IoT Vulnerability Hiding in Plain Sight
Walk through any airport terminal, hospital corridor, or corporate lobby, and you will encounter digital signage displays. They announce flight departures, guide patients to their appointments, and broadcast company news to employees. These screens have become so common that we barely notice them anymore. And that invisibility is precisely the problem. While cybersecurity teams focus their attention on firewalls, endpoint protection, and cloud security, digital signage systems often slip under the radar as low-priority assets. Hackers, however, have taken notice.
700Credit Breach: What Organizations Need to Know
700Credit, a US-based credit check and compliance provider, disclosed in late October that it had suffered a significant data breach affecting nearly 18,000 dealerships and more than 5.6 million consumers. According to the company’s disclosure and subsequent reporting, the exposed data includes names, addresses, dates of birth, and Social Security numbers.
CVE-2025-66675: Apache Struts DoS Vulnerability Leads to Disk Exhaustion
A newly disclosed denial-of-service vulnerability, CVE-2025-66675, affects a wide range of Apache Struts 2 versions and poses a serious availability risk for applications that handle file uploads. While the EPSS score is 0.05%, indicating a low probability of exploitation in the next 30 days, the vulnerability still represents a high availability risk for exposed and unpatched environments.
Modern Exposure Management Is About Outcomes, Not Alerts
Modern exposure management has evolved beyond vulnerability scanning and alert volume into a discipline focused on measurable risk reduction. As the exposure management market matures, security leaders are adopting cyber exposure management platforms that unify signals across vulnerability, cloud, application, and attack surface tools to prioritize what truly matters.
CVE-2025-40602: SonicWall Releases Fix for SMA1000 Privilege Escalation Zero-Day Under Active Attack
On December 17, 2025, SonicWall released fixes for an actively exploited medium-severity zero-day vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC), tracked as CVE-2025-40602. The vulnerability allows local threat actors to escalate privileges due to insufficient authorization in the SMA1000 AMC and does not affect SSL VPN functionality on SonicWall firewalls.
CVE-2025-10573: Stored XSS in Ivanti EPM
A critical stored XSS vulnerability (CVE-2025-10573) in Ivanti Endpoint Manager lets attackers poison the admin dashboard with malicious scripts, leading to session hijacking and device compromise. AppTrana blocks these malicious scan submissions at the edge, preventing stored XSS payloads from ever reaching the EPM dashboard, even before patching.
React After React2Shell: New RSC Vulnerabilities Expose DoS and Source Code Risks
The disclosure of React2Shell (CVE-2025-55182) triggered a rapid patching effort across the React and Next.js ecosystem. However, deeper inspection of React Server Components (RSC) in the aftermath revealed additional vulnerabilities in adjacent code paths. These vulnerabilities pose serious operational and security risks.
How to mitigate CVE-2025-32433
A critical Erlang SSH vulnerability (CVE-2025-32433), also known as Chainbreaker, allows attackers to exploit pre-auth SSH behavior for remote code execution. In this video, we break down exactly what security teams need to do — from immediate mitigation to long-term prevention. What you’ll learn in this video: How to mitigate CVE-2025-32433 by upgrading Erlang OTP (27.3.3 / 26.2.5.11 / 25.3.2.20)
The Future Of Cybersecurity: How AI And Machine Learning Are Transforming Penetration Testing
In today's rapidly evolving digital landscape, the protection of sensitive information and critical infrastructure has become more paramount than ever. Traditional cybersecurity measures are increasingly being augmented with advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML). These innovations are now transforming the realm of penetration testing, offering enhanced capabilities for identifying and mitigating vulnerabilities.
Proactive WAF Vulnerability Protection & Firewall for AI + Multiplayer Chess Demo in ChatGPT
In this episode of This Week in NET, we talk with Daniele Molteni, Director of Product Management for Cloudflare’s WAF, about how Cloudflare responded within hours to a newly disclosed React Server Components vulnerability — deploying global protection before the public advisory was even released.
LevelBlue and Tenable Introduce Unlimited Enterprise-Grade Vulnerability Scanning in USM Platform at No Additional Cost
LevelBlue is redefining what clients and partners can expect from a managed security provider. Through a new partnership with Tenable, a world-class leader in vulnerability management, LevelBlue is introducing unlimited, enterprise-grade vulnerability scanning for all clients and partners using the LevelBlue USM platform — included at no additional cost.
Mastering OWASP Detection: Enterprise Rules for AWS, Akamai, F5, and Cloudflare
Application Security, WAF, and OWASP form an interconnected defense strategy for web applications. OWASP (Open Web Application Security Project) provides the framework for identifying critical vulnerabilities through resources like the OWASP Top 10, while WAFs act as the protective layer that detects and blocks attacks targeting these vulnerabilities in real-time.
How to detect React2Shell attacks using network-based threat hunting
How do you find React2Shell vulnerabilities or detect React2Shell attacks in real environments? In this video, Corelight cloud security researcher David Burkett walks through how to threat hunt React2Shell by focusing on post-exploitation behavior at the network level. Instead of relying on exploit signatures, the approach uses application baselining and network traffic analysis to identify abnormal behavior.
Old AI Security vs Evo: Watch Agentic Security Replace Weeks of Manual Work
From intelligent chatbots to autonomous agents, innovation has never moved faster thanks to GenAI. But with the rate of velocity comes a massive new challenge: a class of complex, non-deterministic security risks that traditional cybersecurity methods are simply not equipped to handle. AI-native applications are already running in production. Across industries, teams are deploying copilots, RAG systems, autonomous agents, and AI-powered workflows faster than traditional security processes can keep up.
How Seal Security Helps You Meet FedRAMP Vulnerability Detection and Response Standard
Earlier this year, FedRAMP RFC-0012 signaled a coming shift in how cloud service providers (CSPs) working with the U.S. federal government are expected to handle vulnerabilities. It outlined plans to move FedRAMP away from simple CVSS-score thresholds and toward continuous, context-aware, exploitability-driven, and automation-first vulnerability management.
Fireside Chat: LevelBlue + Tenable Partnership - Unlimited Vulnerability Scanning at No Cost
Discover how LevelBlue and Tenable are transforming cybersecurity in this exclusive fireside chat featuring Michael Vaughn, Director of Product Management at LevelBlue, and Greg Goetz, VP of Global Strategic Partners at Tenable.
Understanding React2Shell: Critical Remote Code Execution in React Server Components and Next.js
React2Shell is the name commonly used to describe a set of critical vulnerabilities affecting React Server Components (RSC) and frameworks that rely on them, including Next.js. Since disclosure, security teams have observed continued exploitation attempts targeting exposed applications, with attackers abusing the vulnerability to gain unauthorized code execution on affected servers.
Kenna Lit the Spark on the Exposure Management Fire and It's Time for the Next Generation
When Kenna launched more than a decade ago, it reshaped an industry that had grown numb to vulnerability overload. Back then, vulnerability management meant looking at mountains of CSV files, scanner reports, and a never-ending backlog of unprioritized issues. Kenna introduced the idea that risk instead of raw counts should determine what gets fixed first. For many security teams, it was the first time they realized they didn’t have a vulnerability problem.
Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719
In December 12, 2025, Arctic Wolf began observing intrusions involving malicious SSO logins on FortiGate appliances. Fortinet had previously released an advisory for two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) on December 9, 2025. Arctic Wolf had also sent out a security bulletin for the vulnerabilities shortly thereafter.
OWASP Top 10 for Agentic Applications 2026: Key Takeaways & How to Take Action
AI agents connect to APIs, execute code, move data, and make decisions with real permissions in live production environments — introducing a new class of security risks. To help organizations stay ahead, the OWASP GenAI Security Project released the OWASP Top 10 for Agentic Applications 2026. In this post, we’ll provide a summary of each agentic AI risk category defined by OWASP, along with actionable next steps to begin securing your agentic AI projects in 2026 and beyond.
Top 11 SOC 2 Vulnerability Assessment Tools SaaS (2026)
With 66% of B2B customers now checking for SOC 2 vulnerability compliance before signing contracts, vulnerability assessment and continuous security monitoring are now expected not just during annual audits, but as regular operational exercises.
Gemini 3 Pro Generates 7 Code Security Issues
Gemini 3 Pro Generates 7 Code Security Issues.
OWASP Agentic AI Top 10: Why It Matters and How Protecto Reduces Real-World Risk
AI agents are rapidly moving from experimentation into production across finance, healthcare, enterprise IT, and critical infrastructure. Unlike traditional applications, agents plan, reason, delegate, and act autonomously across systems and data sources. This expanded autonomy dramatically increases the security blast radius. To address this shift, OWASP released the OWASP Top 10 for Agentic Applications.
React & Next.js DoS Vulnerability (CVE-2025-55184): What You Need to Fix After React2Shell
If you upgraded only to address CVE-2025-55182 (React2Shell), you may still be vulnerable. CVE-2025-55184 affects adjacent RSC code paths and can allow attackers to take your app offline, even without gaining code execution. You should ensure you’re running the latest patched React and Next.js versions, including fixes for the follow-up CVE-2025-67779.
React2Shell and related RSC vulnerabilities threat brief: early exploitation activity and threat actor techniques
On December 3, 2025, immediately following the public disclosure of the critical, maximum-severity React2Shell vulnerability (CVE-2025-55182), the Cloudforce One Threat Intelligence team began monitoring for early signs of exploitation. Within hours, we observed scanning and active exploitation attempts, including traffic originating from infrastructure associated with Asian-nexus threat groups.
CVE-2025-10573: Critical Unauthenticated Stored XSS in Ivanti Endpoint Manager
A newly disclosed vulnerability in Ivanti Endpoint Manager (EPM) tracked as CVE-2025-10573 allows unauthenticated attackers to inject persistent JavaScript into the EPM administrative dashboard. Assigned a CVSS score of 9.6, this vulnerability presents a critical security risk because it enables attackers to hijack administrator sessions and gain full control over managed endpoints.
CVE-2025-55182: React2Shell - A Critical RCE in React Server Components and Its Rapid Exploitation
On December 3, 2025, CVE-2025-55182, a critical remote code execution (RCE) vulnerability in React Server Components (RSC), dubbed “React2Shell.” This flaw, carrying a maximum CVSS v3.1 score of 10.0 (Attack Vector: Network; Attack Complexity: Low; Privileges Required: None; User Interaction: None; Scope: Unchanged; Confidentiality/Integrity/Availability: High), stems from unsafe deserialization in the RSC “Flight” protocol.
What's Next in Cyber Economics: 2026 Security Strategies from Industry Leaders
Security leaders are bracing for a pivotal shift in 2026. Attacker economics are evolving, extortion models are changing shape, and organizations are rethinking how they allocate resources to defend against more scalable and financially motivated threats. In this on-demand webinar, four industry experts break down the forces reshaping cybersecurity strategy and offer practical guidance for leaders preparing for the next wave of challenges.
The Security Blind Spots Most Operators Miss - According to Igor Finkelshtein
In the cybersecurity world, it's easy to focus on the latest breach or high-profile vulnerability. But according to multi-industry operator Igor Finkelshtein, most security incidents don't begin with sophisticated attacks - they begin with overlooked operational weaknesses. From transportation to real estate to SaaS platforms, Finkelshtein's experience shows that cybersecurity is ultimately an operational discipline. The vulnerabilities that quietly accumulate inside a business often pose a greater risk than anything happening outside it.
The OWASP Top 10 for Agentic Applications: A Milestone for the Future of AI Security
The OWASP GenAI Security Project has officially released its Top 10 for Agentic Applications, the first industry-standard framework focused on the operational risks created by autonomous and semi-autonomous AI systems. AI has evolved in a way that directly changes how enterprises need to think about security. We started with machine learning systems designed to classify and predict.
React2Shell: The Frontend Vulnerability That Unlocks Your Internal APIs
The cybersecurity world is currently buzzing about React2Shell (CVE-2025-55182), a critical remote code execution (RCE) vulnerability affecting React and Next.js. The scale of the threat is massive: researchers have already identified over 77,000 vulnerable IP addresses exposed to the internet, and confirmed that state-sponsored actors and opportunistic crypto miners have already breached at least 30 organizations. But if you look closely, this isn't really a story about React.
CVE-2025-59718 and CVE-2025-59719: FortiCloud SSO Login Authentication Bypass
On December 9, 2025, Fortinet released an advisory detailing two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Designated CVE-2025-59718 and CVE-2025-59719, these vulnerabilities allow an unauthenticated threat actor to bypass FortiCloud SSO login authentication via a crafted SAML message if the feature is enabled on the device. Fortinet states that FortiCloud SSO login is disabled by default in factory settings.
OWASP Top 10 for Agentic Applications (2026): What Developers and Security Teams Need to Know
Agentic AI is moving into production in CI/CD pipelines, internal copilots, customer support workflows, and infrastructure automation. These systems no longer just call a model. They plan, decide, delegate, and take actions on behalf of users and other systems. This creates new attack surfaces that do not map cleanly to traditional application security or even the OWASP Top 10 2025.
CVE-2025-66516: Critical XXE Vulnerability Exposes Apache Tika Deployments
A critical XXE vulnerability, CVE-2025-66516, has been discovered in Apache Tika, putting any workflow that processes PDFs at serious risk. A malicious PDF can trigger the exploit through any Tika workflow, silently giving attackers access to sensitive files, internal URLs, cloud metadata, and your internal network. AppTrana blocks these malicious PDFs at the edge, keeping your data and internal systems secure.
Decoding CVE-2025-66478: Signal vs. Noise in SCA
Have you decoded CVE-2025-66478?
Outpost24 Acquires Infinipoint to Power Its Entry into the Zero Trust Workforce Access Market
The strategic acquisition strengthens market leadership by unifying user identity with device trust, eliminating security blind spots. STOCKHOLM / PHILADELPHIA (December 9, 2025) – Outpost24, a leader in exposure management and identity security, today announced the acquisition of Infinipoint, a specialist in device identity, posture validation, and secure workforce access.
Insights Agent: From Data to Decisions
Vulnerability and exposure data is only as valuable as the insights you can extract from it. Seemplicity’s Insights Agent changes the game by turning dense vulnerability information into actionable insights, surfacing meaningful trends and generating visual insights. No configuration or guesswork–just fast, contextual analysis that helps security teams focus on what matters most.
Close the "Unfixable" Vulnerability Gap
30% of open source vulnerabilities are marked “unfixable”. Not because they can’t be fixed but because traditional tools stop there. Your customers don’t care. They just see unresolved CVEs. And they won’t sign off on software that fails a scan. That’s where the real business risk lies. In mid-size software companies, “unfixable” means delayed deals, failed audits, and lost revenue. Seal Security was built to close that 30% gap.
What are you doing to stay safe from supply chain attacks?
Automatic updates were supposed to make us safer. Instead, they’ve become one of the easiest entry points for supply-chain attacks. When a public repository is compromised, an attacker uploads a malicious version and waits, for 30 minutes to a few hours, before the community detects and removes it. During that window, automated tools like Dependabot can pull that version straight into production. That small window of time is enough to compromise thousands of systems.
The Real Remediation Bottleneck
Most teams think vulnerability scanning equals progress. But scanning without effective remediation is just expensive noise. Two things block real fixes: Meanwhile, our own research shows as much as 30% of vulnerabilities in transitive dependencies remain unresolved, simply because upgrades break production. That means most organizations aren’t “secure”. They’re sitting on unfixed issues their scanners excluded.
Cato CTRL Threat Brief: "React2Shell" Vulnerability Targeting React Server Components
On Wednesday, December 3, a critical remote code execution (RCE) vulnerability in React Server Components (RSC), dubbed React2Shell (CVE-2025-55182), was disclosed. The CVE was discovered by security researcher Lachlan Davidson. It quickly gained traction with multiple third-party proof of concepts (PoCs) being published of varying quality and credibility.
CVE-2025-55182: The critical React RCE and the hidden risk in your supply chain
On December 3rd, the React team disclosed a critical security flaw in React Server Components known as CVE-2025-55182. With a CVSS score of 10.0, this issue is extremely severe. React and Next.js are the backbone of the modern web. Consequently, this vulnerability likely sits deep within your third-party vendor ecosystem in addition to your own codebase.
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.
Third-Party Vulnerability: What the Mixpanel Incident Means for Millions of ChatGPT and API Users
In late November 2025, developers and API users of ChatGPT and OpenAI’s platform received a note that felt personal: an alert about a data exposure linked not to OpenAI’s own servers but to a third-party analytics vendor. That vendor was Mixpanel.
Google Gemini 3 Pro Builds an App with ONE PROMPT...
Google announced Gemini 3 Pro, which they tout as their most intelligent model yet that's best for complex tasks and bringing creative concepts to life. We're going to put this model to the test and see how good it is at fulfilling our prompt with a production ready app and the security of the code it produces.
CVE-2025-66516: Critical XXE Vulnerability Exposes Apache Tika Deployments
A critical vulnerability, CVE-2025-66516 (CVSS 10.0), has been identified in Apache Tika, affecting how the framework processes PDF files containing XFA (XML Forms Architecture) data. The vulnerability resides in tika-core, which means any system using Tika’s default parsing behavior remains vulnerable even if the PDF parser module was previously patched. No special configuration or insecure application code is required; simply ingesting a malicious PDF is enough to trigger the exploit.
How to React(.js) to React2Shell and detecting behaviors to catch the Next(.js) big RCE
Critical vulnerabilities in React Server Components (CVE-2025-55182) and Next.js (CVE-2025-66478) enable unauthenticated remote code execution in default configurations. The flaw resides in the "Flight" protocol used for server-side rendering, making it a sought after target for adversaries looking to bypass standard controls. While the public discourse is currently cluttered with unreliable exploits, we need to ground our defense in verifiable network evidence.
Security Update: Critical RCE in React Server Components & Next.js (CVE-2025-55182)
A Critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-55182, has been discovered in Next.js applications utilizing React Server Components (RSC) and Server Actions. This vulnerability stems from insecure deserialization within the underlying “Flight” protocol used by React. Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on the server, potentially leading to a complete compromise of the application and underlying system.
Automating SLAs in Risk-Based Vulnerability Management: Turning Deadlines into Results
Many organizations set remediation SLAs, but static severity-based timelines and manual tracking prevent them from meeting those deadlines in a way that meaningfully reduces risk. This article outlines how automated, risk-based SLAs connect timelines to real exploitability, exposure, and asset value, turning deadlines into reliable, measurable outcomes. Key takeaways from this article.
Critical vLLM Flaw Exposes the Soft Underbelly of AI Infrastructure
While the world worries about "jailbreaking" LLMs or preventing them from hallucinating, a critical new vulnerability has just reminded us of a fundamental truth: AI is just software, and software has bugs. A newly discovered critical flaw (CVE-2025-62164) in vLLM, one of the most popular libraries for serving large language models, allows attackers to achieve Remote Code Execution (RCE) or crash servers simply by sending a malicious API request. This isn't a failure of the AI model.
CVE-2025-55182 and CVE-2025-66478 ("React2Shell"): All you need to know - UPDATED
JFrog continues to track and provide updates on React2Shell at research.jfrog.com.
CVE-2025-54057: Stored XSS Attack Exposes Dashboards
New XSS vulnerability in Apache SkyWalking! CVE-2025-54057 enables stored script injections that steal sessions and manipulate dashboards. Fix + protection steps inside.
CVE-2025-55182: Critical Remote Code Execution Vulnerability Found in React Server Components
On December 3, 2025, the React team released fixes for a maximum severity vulnerability in React Server Components (RSC). The vulnerability, tracked as CVE-2025-55182, stems from unsafe handling of serialized DOM elements, allowing for remote code execution in React 19 and other frameworks built on top of it, such as Next.js 15–16. The vulnerability was responsibly disclosed to React as part of a bug bounty program and is not known to be actively exploited in the wild at this time.
Security Alert: CVE-2025-66478 & CVE-2025-55182 (React2Shell) - Next.js React Server Components Remote Code Execution
A critical vulnerability, CVE-2025-66478, has been identified in Next.js applications using React Server Components (RSC) with the App Router. This vulnerability receives a CVSS score of 10.0 and a Bitsight Dynamic Vulnerability Exploit (DVE) score of 7.85. This vulnerability may allow remote code execution (RCE) when affected servers process attacker-controlled RSC requests. CVE-2025-66478 is tied to an upstream React issue (CVE-2025-55182–DVE score 9.15) affecting the RSC protocol implementation.
From Zero to RCE: How a Single HTTP Request Compromises React and Next.js Applications
On December 3, 2025, the React team disclosed CVE-2025-55182, a critical remote code execution vulnerability in React Server Components. The flaw carries a CVSS score of 10.0, the maximum severity rating. What makes this vulnerability particularly dangerous is its simplicity: attackers only need to send a single crafted HTTP request to gain complete control over vulnerable servers. No authentication required. No complex exploit chains. Just one malicious request.
Emerging Threat: CVE-2025-55182 (React2Shell) - React Server Components RCE Vulnerability
On December 3 2025, the React team released patched versions of the affected React Server Components packages. Framework vendors, including Next.js, provided updated builds on the same day. Any environment using React Server Components or frameworks that embed the RSC pipeline should.
React and Next.js unauthenticated remote code execution (CVE-2025-55182, CVE-2025-66478)
On 29 November 2025, researcher Lachlan Davidson reported a critical React vulnerability that allows unauthenticated remote code execution via specially crafted React Server Function payloads. This vulnerability was disclosed as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) and is rated CVSS 10.0. A public proof concept has also been released so patching is of utmost importance.
Understanding and Mitigating CVE-2025-55182 (React2Shell)
Designated CVE-2025-55182 and widely dubbed "React2Shell," this vulnerability represents a worst-case scenario for modern web applications: Unauthenticated Remote Code Execution (RCE) on default configurations.
CVSS 10.0 CVE in React & Next.js: How You Can Stay Safe
On December 3rd, CVE-2025-55182 was published by CISA. This CVSS 10.0 vulnerability allows unauthenticated remote code execution, where a threat actor can exploit a flaw in React’s process to decode payloads sent to React Server Function endpoints. It is important to note that while not every team is using React Server Function endpoints in their app, they still may be vulnerable if their app supports React Server Components.
Learn How Veracode Stops Attackers from Exploiting Vulnerabilities from Founder Chris Wysopal.
Hear from Veracode's Founder and Chief Evangelist, Chris Wysopal, on how attackers compromise organizations by scanning applications for vulnerabilities in code, APIs, mobile integrations, and cloud environments. Vulnerabilities enter systems through feature updates, open-source components, and third-party code—creating constant exposure.
Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows
On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments.
Cloudflare WAF proactively protects against React vulnerability
Cloudflare has deployed a new protection to address a vulnerability in React Server Components (RSC). All Cloudflare customers are automatically protected, including those on free and paid plans, as long as their React application traffic is proxied through the Cloudflare Web Application Firewall (WAF). Cloudflare Workers are inherently immune to this exploit. React-based applications and frameworks deployed on Workers are not affected by this vulnerability.
Security Advisory: Critical RCE Vulnerabilities in React Server Components & Next.js (CVE-2025-55182 / CVE-2025-66478)
On December 3, 2025, coordinated disclosures revealed that multiple releases of React 19 and Next.js contain a critical flaw in the React Server Components (RSC) “Flight” protocol, allowing unauthenticated remote code execution (RCE). The vulnerability originates from unsafe deserialization of attacker-controlled data in server-side RSC payload handling.
Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers
Artificial Intelligence (AI) is transforming software development with agentic coding tools like GitHub Copilot and Cursor, leading the charge. These tools use AI to assist developers in writing code, automate repetitive tasks, and expedite the development process.
Vibe Code Prompt to Build an Application!
Vibe Code Prompt to Build an Application!
PyTorch Users at Risk: Unveiling 3 Zero-Day PickleScan Vulnerabilities
JFrog Security Research found 3 zero-day critical vulnerabilities in PickleScan, which would allow attackers to bypass the most popular Pickle model scanning tool. PickleScan is a widely used, industry-standard tool for scanning ML models and ensuring they contain no malicious content.
Defining and Defending Against a Zero Day Attack
Unexpected attacks are the hardest to fend off. In the realm of cyber, Zero Day vulnerabilities are among the greatest risks, as these software flaws are unknown and exploited before a fix is available, potentially compromising the thousands of organizations that are unwittingly using vulnerable software.
CVE-2025-54057: Stored XSS Vulnerability in Apache SkyWalking Exposes Monitoring Dashboards to Attackers
Apache SkyWalking is one of the most widely adopted open-source Application Performance Monitoring (APM) and observability platforms, trusted by developers and DevOps teams to visualize telemetry, trace distributed systems, and ensure application uptime. However, a recently disclosed vulnerability has revealed that the very dashboards designed to improve visibility could be turned into attack vectors.
Defining and Defending Against a Zero Day Attack
Unexpected attacks are the hardest to fend off. In the realm of cyber, Zero Day vulnerabilities are among the greatest risks, as these software flaws are unknown and exploited before a fix is available, potentially compromising the thousands of organizations that are unwittingly using vulnerable software.
Best 5 Platforms to Help Eliminate CVEs from Container Images
The rapid adoption of containerized applications has reshaped software development and deployment across industries. Containers allow teams to deliver updates faster, scale efficiently, and manage dependencies with precision. However, this flexibility comes with a critical challenge: vulnerabilities hidden inside container images.
Can Claude Opus 4.5 Build a SECURE Note Taking App?
Can Claude Opus 4.5 actually build a secure, fully functional note-taking app? In this video, I challenge the latest Claude model to create an app with real features — create, edit, update, delete, plus basic security — and see if the code holds up in practice. This is a real test of how far AI can go in building usable software.
Secure your code at scale with AI-driven vulnerability management
As development teams adopt generative AI at an unprecedented pace, security teams face an evolving set of challenges in securing the software development life cycle. The increasing speed and scale of code changes make it more difficult for organizations to manage risk effectively. Legacy scanners often fail to keep up, returning slow results and noisy alerts that increase remediation time and leave organizations exposed to potential breaches.