Keith McCammon’s career in cybersecurity was shaped by self-education, problem-solving, and experience in national security, despite lacking formal training. His insights highlight the importance of communication and composure in cybersecurity leadership, as well as the evolving threats posed by professionalized cybercriminals. #CarbonBlack #RedCanary…
Category: Cyber Security News
Google and Apple have issued global cybersecurity alerts warning users of targeted surveillance by state-linked hackers and commercial spyware vendors like Intellexa. These notifications highlight the growing threat of government-backed digital espionage and the widespread use of advanced spyware tools worldwide. #Intellexa #StateLinkedHackers…
The Barts Health NHS Trust experienced a data breach caused by the Cl0p ransomware group exploiting an Oracle E-Business Suite vulnerability. The stolen files, containing personal information and payment details, were posted on the dark web, but core healthcare systems remain secure. #Cl0p #OracleE-BusinessSuite…
A Russian threat actor, UTA0355, conducts targeted phishing campaigns impersonating international security events to steal Microsoft 365 credentials. The group employs advanced social engineering tactics and manipulates OAuth workflows, leveraging compromised accounts for increased trust. #UTA0355 #BelgradeSecurityConference #BrusselsIndoPacificDialogue #MicrosoftOAuth…
Portugal has updated its cybercrime legislation to protect security researchers acting in good faith, under strict conditions, from criminal liability. This development aligns with similar protections introduced by Germany and the US, promoting responsible vulnerability disclosure. #PortugalCyberlaw #SecurityResearch #LegalSafeHarbor
![Cybersecurity News | Daily Recap [06 Dec 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [06 Dec 2025]")
Daily Recap, Active exploitation of the critical React2Shell flaw pushed it onto the CISA KEV list, with Chinese actors and Amazon researchers reporting widespread abuse that even triggered a Cloudflare outage. The report also highlights CVE-2025-66516 in Apache Tika enabling XXE and possible RCE, a Barts Health NHS data breach caused by an Oracle zero-day, a resurgence of LockBit activity, EU penalties on X under the Digital Services Act, and the Agentic Wiper threat capable of auto-deleting Google Drive.
#React2Shell #CISAKEV #CloudflareOutage #ApacheTika #CVE-2025-66516 #BartsHealthNHS #LockBit #AgenticWiper #GoogleDrive #X #DigitalServicesAct
A recent cyber campaign targeted Palo Alto GlobalProtect portals with brute-force login attempts and scanning activities, then shifted focus to SonicWall SonicOS API endpoints. The attacks originated from over 7,000 IP addresses operated by German hosting provider 3xK GmbH, highlighting ongoing credential-based threat activities. #GlobalProtect #SonicWallSonicOS #3xKGmbH
Over 77,000 IP addresses are vulnerable to the critical React2Shell remote code execution flaw (CVE-2025-55182), with attackers already compromising over 30 organizations. Widespread exploitation involves Chinese threat actors using PowerShell and malware like Snowlight and Vshell to access and control affected systems. #React2Shell #CVE-2025-55182 #ChineseThreatActors
Over 30 vulnerabilities, collectively called IDEsaster, have been discovered in AI-powered IDEs, enabling data exfiltration and remote code execution through prompt injection and legitimate feature abuse. These security flaws affect popular tools like GitHub Copilot, Cursor, Roo Code, and others, highlighting the need for trusted sources and system hardening. #IDEsaster #PromptInjection…
The U.S. CISA has added the critical React2Shell vulnerability (CVE-2025-55182) to its KEV list, highlighting active exploitation in the wild. Multiple threat actors, including Chinese hacking groups, are targeting affected React Server Components and frameworks such as Next.js and Vite. #React2Shell #CISA #ChinaHackingGroups…
Daily Recap, exploits ranging from React2Shell flaws in React/Next.js being actively exploited by China-linked groups to a Cloudflare outage caused by emergency patches highlight persistent risks across web infrastructure. BRICKSTORM activity by PRC-linked actors targeting VMware vSphere in U.S. networks, alongside campaigns such as Array Networks gateway exploitation, Sha1-Hulud supply-chain worm, and Intellexa and Predator surveillance tools, illustrate a broad threat landscape. #React2Shell #BRICKSTORM
A Maryland man was sentenced to prison for allowing North Koreans to use his identity for software development work with US government agencies like the FAA. The case highlights North Korea’s ongoing efforts to fund itself through international worker scams. #NorthKorea #IdentityFraud…
Two hacking groups linked to China quickly exploited a critical React Server Components vulnerability, CVE-2025-55182, after its public disclosure. This exploit activity was observed targeting various sectors across multiple regions, highlighting a broad and systematic attack effort. #React2Shell #ChinaLinkedThreatActors…
A critical security vulnerability (CVE-2025-66516) has been identified in Apache Tika, enabling XXE injection attacks that can lead to remote code execution. Users are urged to update to version 2.0.0 or later to prevent potential exploits. #ApacheTika #XXE #Vulnerability #CVE202566516…
A new agentic browser attack exploits natural language prompts to automatically delete Google Drive contents without user confirmation, posing significant security risks. The attack leverages excessive agency in AI-powered assistants and URL fragment manipulation, highlighting vulnerabilities in AI browser security. #GoogleDriveWiper #HashJack #Perplexity #AIvulnerabilities…