Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

indusface

React After React2Shell: New RSC Vulnerabilities Expose DoS and Source Code Risks

Dec 17, 2025 By Bhargavi Pallati In Indusface
The disclosure of React2Shell (CVE-2025-55182) triggered a rapid patching effort across the React and Next.js ecosystem. However, deeper inspection of React Server Components (RSC) in the aftermath revealed additional vulnerabilities in adjacent code paths. These vulnerabilities pose serious operational and security risks.
Read Post

How to mitigate CVE-2025-32433

Dec 17, 2025 By Fidelis Security In Fidelis Security
A critical Erlang SSH vulnerability (CVE-2025-32433), also known as Chainbreaker, allows attackers to exploit pre-auth SSH behavior for remote code execution. In this video, we break down exactly what security teams need to do — from immediate mitigation to long-term prevention. What you’ll learn in this video: How to mitigate CVE-2025-32433 by upgrading Erlang OTP (27.3.3 / 26.2.5.11 / 25.3.2.20)
View Video
outpost 24

700Credit Breach: What Organizations Need to Know

Dec 17, 2025 By Dominique Adams In Outpost 24
700Credit, a US-based credit check and compliance provider, disclosed in late October that it had suffered a significant data breach affecting nearly 18,000 dealerships and more than 5.6 million consumers. According to the company’s disclosure and subsequent reporting, the exposed data includes names, addresses, dates of birth, and Social Security numbers.
Read Post
indusface

CVE-2025-66675: Apache Struts DoS Vulnerability Leads to Disk Exhaustion

Dec 17, 2025 By Bhargavi Pallati In Indusface
A newly disclosed denial-of-service vulnerability, CVE-2025-66675, affects a wide range of Apache Struts 2 versions and poses a serious availability risk for applications that handle file uploads. While the EPSS score is 0.05%, indicating a low probability of exploitation in the next 30 days, the vulnerability still represents a high availability risk for exposed and unpatched environments.
Read Post
seemplicity

Modern Exposure Management Is About Outcomes, Not Alerts

Dec 17, 2025 By Megan Horner In Seemplicity
Modern exposure management has evolved beyond vulnerability scanning and alert volume into a discipline focused on measurable risk reduction. As the exposure management market matures, security leaders are adopting cyber exposure management platforms that unify signals across vulnerability, cloud, application, and attack surface tools to prioritize what truly matters.
Read Post
Arctic Wolf

CVE-2025-40602: SonicWall Releases Fix for SMA1000 Privilege Escalation Zero-Day Under Active Attack

Dec 17, 2025 By Andres Ramos In Arctic Wolf
On December 17, 2025, SonicWall released fixes for an actively exploited medium-severity zero-day vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC), tracked as CVE-2025-40602. The vulnerability allows local threat actors to escalate privileges due to insufficient authorization in the SMA1000 AMC and does not affect SSL VPN functionality on SonicWall firewalls.
Read Post

CVE-2025-10573: Stored XSS in Ivanti EPM

Dec 17, 2025 By Indusface In Indusface
A critical stored XSS vulnerability (CVE-2025-10573) in Ivanti Endpoint Manager lets attackers poison the admin dashboard with malicious scripts, leading to session hijacking and device compromise. AppTrana blocks these malicious scan submissions at the edge, preventing stored XSS payloads from ever reaching the EPM dashboard, even before patching.
View Video
THE FUTURE OF CYBERSECURITY: HOW AI AND MACHINE LEARNING ARE TRANSFORMING PENETRATION TESTING

The Future Of Cybersecurity: How AI And Machine Learning Are Transforming Penetration Testing

Dec 17, 2025 By SecuritySenses In SecuritySenses
In today's rapidly evolving digital landscape, the protection of sensitive information and critical infrastructure has become more paramount than ever. Traditional cybersecurity measures are increasingly being augmented with advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML). These innovations are now transforming the realm of penetration testing, offering enhanced capabilities for identifying and mitigating vulnerabilities.
Read Post
coralogix

Mastering OWASP Detection: Enterprise Rules for AWS, Akamai, F5, and Cloudflare

Dec 16, 2025 By Bhim Singh and Vaibhav Tiwari In Coralogix
Application Security, WAF, and OWASP form an interconnected defense strategy for web applications. OWASP (Open Web Application Security Project) provides the framework for identifying critical vulnerabilities through resources like the OWASP Top 10, while WAFs act as the protective layer that detects and blocks attacks targeting these vulnerabilities in real-time.
Read Post

How to detect React2Shell attacks using network-based threat hunting

Dec 16, 2025 By Corelight In Corelight
How do you find React2Shell vulnerabilities or detect React2Shell attacks in real environments? In this video, Corelight cloud security researcher David Burkett walks through how to threat hunt React2Shell by focusing on post-exploitation behavior at the network level. Instead of relying on exploit signatures, the approach uses application baselining and network traffic analysis to identify abnormal behavior.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.