A big finish to 2025 in December’s Patch Tuesday

Eduard Kovacs reports: California-based health technology and consumer electronics company Masimo Corporation has been targeted in a cyberattack that impacted its manufacturing facilities. The company said in a filing with the SEC that it detected unauthorized access on its network on April 27. “As a result of the incident, certain of the Company’s manufacturing facilities…

Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below – chrono_anchor dnp3times time_calibrator time_calibrators time-sync The crates, per Socket, impersonate timeapi.io and were published between late February and early March

Pieter Arntz reports: Google has issued a patch for a high‑severity Chrome zero‑day, tracked as CVE‑2026‑2441, a memory bug in how the browser handles certain font features that attackers are already exploiting. CVE-2026-2441 has the questionable honor of being the first Chrome zero-day of 2026. Google considered it serious enough to issue a separate update of the stable……

NL Times reports: The Dutch Public Prosecution Service (Openbaar Ministerie, OM) has begun reconnecting its systems to the internet after a cyberattack last month forced a full digital shutdown. External experts have determined it is now safe to bring the systems back online gradually. According to the OM, no data was stolen or altered in the attack. The…

The European Network and Information Security Agency, ENISA, has compiled a list of existing initiatives focused on finding and preventing software vulnerabilities.

Cybersecurity researchers have uncovered malicious libraries in the Python Package Index (PyPI) repository that are designed to steal sensitive information. Two of the packages, bitcoinlibdbfix and bitcoinlib-dev, masquerade as fixes for recent issues detected in a legitimate Python module called bitcoinlib, according to ReversingLabs. A third package discovered by Socket, disgrasya, contained a