Cybersecurity News | Daily Recap [05 Dec 2025]

hendryadrian.com

hendryadrian.com

Vulnerabilities & Outages

• React2Shell flaws in React/Next.js are being actively exploited by China-linked groups and emergency patches caused a major Cloudflare outage with widespread 500 errors – React2Shell, Cloudflare Outage, React2Shell
• Critical RCE in React/Next.js lets attackers run code on servers, expanding the risk from the React2Shell campaign – React RCE

Nation-State Threats

• BRICKSTORM — CISA and NSA warn PRC-linked actors are using BRICKSTORM to gain long-term access and target VMware vSphere environments in U.S. networks – BRICKSTORM, BRICKSTORM, BRICKSTORM

Network Gear Exploits

• An active command injection in Array Networks AG gateways has been exploited since August in Japan, allowing attackers to plant web shells on unpatched devices – Array AG, Array AG, Array Webshells

Spyware & Surveillance

• Intellexa leaks reveal remote-access tooling, zero-days and ad-based delivery vectors used for live surveillance operations – Intellexa Leak, Intellexa Zero-Days
• Predator spyware is now employing a new zero-click infection vector and researchers link sanctioned vendors to an iOS zero-day chain used against Egypt-based targets – Predator Vector, iOS Zero-Day

APT Activity & Phishing

• Calisto (Russia-linked) targeted Reporters Without Borders with custom AiTM phishing and a “missing file” lure, matching broader phishing campaigns attributed to Russia – Calisto, Calisto Phishing
• Patchwork deployed the StreamSpy trojan that hides C2 commands in WebSocket traffic for stealth espionage; Silver Fox used a fake Teams installer to deploy ValleyRAT inside China — active targeted campaigns persist – StreamSpy, ValleyRAT

DDoS & Botnets

• The Aisuru botnet powered a record-breaking DDoS that peaked at roughly 29–29.7 Tbps, marking a new volumetric high for internet-scale attacks – Aisuru 29 Tbps, Aisuru 29.7 Tbps

Supply Chain & Infrastructure Abuse

• Sha1-Hulud resurged as an npm/GitHub worm, infecting ~1,000 packages and adding cross-platform, self-destruct and GitHub Actions RCE features in a large supply-chain campaign – Sha1-Hulud
• Researchers found an Indonesian online gambling network doubling as hidden C2 and anonymity infrastructure abused by threat actors – Gambling C2
• New analysis shows methods for de-anonymizing threat actors using infostealer intelligence and how attackers leverage legitimate IT tools for takeover and persistence – Infostealer Intel, Real IT Tools

Patch & Mitigation

• Google pushed a Chrome update fixing 13 vulnerabilities (including critical CVE-2025-13633 in Digital Credentials) and urges billions of users to update now – Chrome Update
• Microsoft silently mitigated a Windows LNK zero-day (CVE-2025-9491) exploited in active campaigns by state-backed groups, while authorities added two known-exploited flaws to mandatory catalogs and the NCSC expanded proactive notifications for exposed devices – Windows LNK, CISA Catalog, NCSC Notifications

Breaches & Incidents

• Pharma company Inotiv disclosed a data breach following a ransomware attack that exposed sensitive research and personal data – Inotiv Breach
• Accusations and arrests surface over intentional deletion of government FOIA databases: contractors with prior hacking records and two Virginia brothers are tied to wiping dozens of federal databases, raising alarm about insider/contractor risk – Contractors Wipe, Virginia Brothers

Business & Funding

• Lumia Security raised $18M to expand AI security and governance offerings – Lumia $18M
• Helmet Security emerged from stealth with $9M in funding and new product plans – Helmet $9M
• 7AI secured $130M in funding for agentic security technology, and the sector saw ~30 M&A deals in November – 7AI $130M, M&A Roundup
• An MSP-focused anti-sales guide, “Getting to Yes,” and OT password policy guidance published for defenders and service providers – MSP Guide, OT Passwords

Policy, Regulation & Research

• India rolled back an order to preinstall a cybersecurity app on smartphones amid privacy and logistics concerns – India Rollback
• British officials seek to expand facial recognition use while Russia blocks FaceTime and Snapchat over alleged misuse in attacks; NATO ran its largest-ever cyber defense exercise as threats rise – UK Face Recognition, Russia Blocks Apps, NATO Exercise
• Academic and industry research highlights include using poetry to bypass LLM guardrails about 50% of the time and new methods to de-anonymize attackers from infostealer data – LLM Guardrails, De-anonymizing Threats

Cybersecurity News | Daily Recap – hendryadrian.com