On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across customer environments.

In the digital age, where a smartphone holds the keys to our lives—messages, photos, locations, secrets—few threats loom as insidiously as Pegasus. Developed by Israel’s NSO Group, this zero-click spyware doesn’t need you to tap a link or download a file. Instead, it slips in silently via a missed iMessage, a WhatsApp call you ignore, or a system notification you never see.

The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.

In February 2023, a Stanford University student conducted a study that turned into one of the most widely followed security tests in AI history. Kevin Liu performed a simple prompt-injection attack, tricking Microsoft Bing Chat into disclosing its internal codename, Sydney, and exposing the entire list of its system prompts. The attack utilized no high-end toolkit, no zero-day, and no privileges, only specially crafted natural language.

A database-as-a-service (DBaaS) product eliminates the complexity of managing database infrastructure while reducing operational costs by up to 40%. Organizations can provision, configure, and scale databases instantly without hardware maintenance or software updates. MariaDB’s recent SkySQL reacquisition highlights the market shift toward flexible deployment models that support self-managed, hybrid, and fully managed environments.

40 billion, that’s the total number of IoT devices expected to be functional worldwide by 2030; 4.3 billion are estimated to be functional in the EU by the end of December. Add to these, hardware, software, connected devices, embedded components, third-party libraries, and more: all shipped with weak security, inconsistent patching & little (if any) long-term support.

On December 3, 2025, the React team released fixes for a maximum severity vulnerability in React Server Components (RSC). The vulnerability, tracked as CVE-2025-55182, stems from unsafe handling of serialized DOM elements, allowing for remote code execution in React 19 and other frameworks built on top of it, such as Next.js 15–16. The vulnerability was responsibly disclosed to React as part of a bug bounty program and is not known to be actively exploited in the wild at this time.