A big finish to 2025 in December’s Patch Tuesday
A month with no Critical-severity Windows bugs is overshadowed by a mass of Mariner mop-up
Categories: X-ops
Tags: threat research, featured, Microsoft, Patch Tuesday, zero days
Similar Posts
From Triage to Threat Hunts: How AI Accelerates SecOps
Bys sIf you work in security operations, the concept of the AI SOC agent is likely familiar. Early narratives promised total autonomy. Vendors seized on the idea of the “Autonomous SOC” and suggested a future where algorithms replaced analysts. That future has not arrived. We have not seen mass layoffs or empty security operations centers. We…
Nigerian National Convicted by Federal Jury of Wire Fraud, Aggravated Identity Theft, and Unauthorized Access to Protected Computer
Bys sGreenbelt, Maryland – After a six-day trial, a federal jury convicted Olusegun Samson Adejorin, 32, a Nigerian national, of wire fraud, aggravated identity theft, and unauthorized access to a protected computer to obtain information. Adejorin was previously extradited from Ghana in connection with the case. Kelly O. Hayes, U.S. Attorney for the District of Maryland, announced the……
Capita hit with £14m fine for personal data breach in 2023 cyber attack
Bys sThe Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber attack in April 2023 which saw hackers gain access to over 6m people’s data. Stroud News & Journal reports: Outsourcing giant Capita has been fined £14 million by the Information Commissioner’s Office (ICO) for failing to……
Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerability
Bys sFortra has disclosed details of a critical security flaw in GoAnywhere Managed File Transfer (MFT) software that could result in the execution of arbitrary commands. The vulnerability, tracked as CVE-2025-10035, carries a CVSS score of 10.0, indicating maximum severity. “A deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a…
Over 46,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack
Bys sCybersecurity researchers are calling attention to a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024 as part of a likely financially motivated effort. “The packages were systematically published over an extended period, flooding the npm registry with junk packages that survived in the ecosystem for almost…
Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit
Bys sSamsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-4632 (CVSS score: 9.8), has been described as a path traversal flaw. “Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version…