Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On 29 November 2025, researcher Lachlan Davidson reported a critical React vulnerability that allows unauthenticated remote code execution via specially crafted React Server Function payloads. This vulnerability was disclosed as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) and is rated CVSS 10.0. A public proof concept has also been released so patching is of utmost importance.

On December 3 2025, the React team released patched versions of the affected React Server Components packages. Framework vendors, including Next.js, provided updated builds on the same day. Any environment using React Server Components or frameworks that embed the RSC pipeline should.

Let’s face it, AI is everywhere now. It has moved from novelty to necessity, reshaping the way we work, make decisions and secure our organizations. It guides how we plan trips, shop for essentials and discover information – but one of its most profound impacts is happening across enterprise environments.

Microsoft 365 has become the backbone of modern business productivity, with more than 450 million paid seats and over 300 million monthly Teams users. But this widespread adoption comes with a sobering reality: Microsoft 365 is now a prime target for cybercriminals worldwide.

40 billion, that’s the total number of IoT devices expected to be functional worldwide by 2030; 4.3 billion are estimated to be functional in the EU by the end of December. Add to these, hardware, software, connected devices, embedded components, third-party libraries, and more: all shipped with weak security, inconsistent patching & little (if any) long-term support.

In February 2023, a Stanford University student conducted a study that turned into one of the most widely followed security tests in AI history. Kevin Liu performed a simple prompt-injection attack, tricking Microsoft Bing Chat into disclosing its internal codename, Sydney, and exposing the entire list of its system prompts. The attack utilized no high-end toolkit, no zero-day, and no privileges, only specially crafted natural language.

In the digital age, where a smartphone holds the keys to our lives—messages, photos, locations, secrets—few threats loom as insidiously as Pegasus. Developed by Israel’s NSO Group, this zero-click spyware doesn’t need you to tap a link or download a file. Instead, it slips in silently via a missed iMessage, a WhatsApp call you ignore, or a system notification you never see.

Since November 3, 2025, KnowBe4 Threat Labs has been monitoring a highly sophisticated, multi-stage phishing operation that is actively targeting organizations to steal employees’ Microsoft 365 credentials. The campaign has been engineered to bypass traditional email security defenses, such as secure email gateways (SEGs), and multi-factor authentication (MFA) tools.

Sophisticated online fraud techniques are growing more accessible to unskilled attackers, driven by AI tools and fraud-as-a-service platforms, according to Sumsub’s latest Identity Fraud Report. “hile the volume of attacks remains staggering, the nature of fraud is shifting,” the researchers write.

On December 3, 2025, the React team disclosed CVE-2025-55182, a critical remote code execution vulnerability in React Server Components. The flaw carries a CVSS score of 10.0, the maximum severity rating. What makes this vulnerability particularly dangerous is its simplicity: attackers only need to send a single crafted HTTP request to gain complete control over vulnerable servers. No authentication required. No complex exploit chains. Just one malicious request.