Welcome to your daily cybersecurity briefing.

Russia has blocked access to Apple’s FaceTime platform and Snap’s Snapchat service, citing their alleged use in coordinating terrorist operations, recruiting criminal actors, and facilitating large-scale fraud against Russian citizens. The decision follows a pattern of escalating restrictions targeting foreign communication platforms, including recent bans on Roblox, Viber, and Signal, with WhatsApp now reportedly under consideration for nationwide blocking.

Google has released a critical Chrome update addressing thirteen security issues, four classified as high severity. One of the flaws, CVE-2025-13633, is a use-after-free vulnerability in Chrome’s Digital Credentials feature that could enable heap corruption through a malicious HTML payload once the renderer process is compromised. Given Chrome’s massive global user base, timely patching is essential across both Chrome and Chromium-derived browsers.

FIRST Fondation  highlights how its A4 program is strengthening national CSIRTs by transforming raw threat intelligence into actionable operational outputs. Through on-site engagements with teams in The Bahamas, Cameroon, Malawi, and Trinidad and Tobago, A4 focuses on analysis workflows, communication readiness, stakeholder coordination, and integration into global trust networks such as the Multi-Stakeholder Ransomware SIG.

A new Python-based CVE-2025-55182 Surface Scanner has been released to detect exposed React Server Components endpoints in ReactJS and Next.js environments. Instead of attempting exploitation, the tool identifies systems that accept RSC protocol traffic and Next.js action headers, signalling a potential attack surface that may lead to remote code execution if further module-mapping and gadget enumeration confirm the presence of exploitable conditions.
Don’t Think – Patch Now!
Listen to the full show here.

Sources:
https://www.bleepingcomputer.com/news/security/russia-blocks-facetime-and-snapchat-over-use-in-terrorist-attacks/
https://www.malwarebytes.com/blog/news/2025/12/google-fixes-13-security-issues-affecting-billions
https://www.first.org/blog/20251201-NatCSIRT
https://cyberpress.org/new-scanner-tool-for-detecting/

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

DeepSeek Releases V3.2 Open Source Model Rivaling GPT-5
The Chinese AI startup DeepSeek has officially released its V3.2 and V3.2-Speciale models under a fully permissive MIT license. Claiming to outperform GPT-5 in reasoning tasks, the release utilizes a novel "Sparse Attention" architecture to maximize efficiency, marking a significant shift in the open-source AI landscape.

CISA Adds Android Framework Flaws to KEV Catalog
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with two critical flaws affecting the Android Framework. The vulnerabilities, involving privilege escalation and information disclosure, are currently being exploited in the wild, requiring immediate attention from federal agencies and mobile fleet managers.

CERT-FR Warns of Critical Python Denial of Service Risks
France's CERT-FR has issued an alert regarding multiple vulnerabilities within the Python runtime environment. These flaws allow remote attackers to trigger Denial of Service (DoS) conditions on unpatched systems, threatening the availability of backend infrastructure and web applications relying on the language.

Microsoft Silently Mitigates Windows LNK Zero-Day
Microsoft has deployed a silent mitigation for a high-severity LNK vulnerability (CVE-2025-9491) actively exploited by state-sponsored groups. The update changes how shortcut target fields are displayed to reveal malicious whitespace padding, though experts warn it does not fully block the execution of malicious payloads.

Critical Security Advisory Issued for Next.js Framework
A new security advisory has been published for Next.js, the popular React framework. The vulnerability, detailed in a GitHub Security Advisory, poses risks to applications using affected versions. Developers are urged to review the disclosure and upgrade their dependencies to the latest stable release immediately.

Don’t Think – Patch Now!

Sources:

• GitHub – DeepSeek V3.2 Release https://github.com/deepseek-ai/DeepSeek-V3.2-Exp
• CISA – KEV Catalog Update https://www.cisa.gov/news-events/alerts/2025/12/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CERT-FR – Python Vulnerability Alert https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1060/
• BleepingComputer – Microsoft LNK Mitigation https://www.bleepingcomputer.com/news/microsoft/microsoft-mitigates-windows-lnk-flaw-exploited-as-zero-day/

GitHub – Next.js Security Advisory https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

Raspberry Pi Raises Prices Amid Rising Production Costs
Raspberry Pi has announced a price increase across several models, citing sustained rises in manufacturing and component costs. The company explains that it can no longer absorb global supply chain pressures. The adjustment will particularly impact integrators, IoT builders, and embedded system deployments relying on low-cost hardware.

Massive Coupang Data Breach Exposes 337 Million Individuals
E-commerce giant Coupang has confirmed a major data breach affecting approximately 337 million users. Exposed data includes personal identification details, contact information, and other sensitive records. The scale of the incident poses significant risks of fraud, identity theft, and highly targeted phishing operations.

Advanced Steganography Techniques Emerge in the Wild
A new analysis highlights the emergence of highly advanced steganography methods used to conceal malicious payloads within multimedia content. These refined techniques improve stealth, evade conventional detection tools, and offer threat actors new covert channels for exfiltration and command-and-control.

India Orders Phone Makers to Pre-Install Government Apps
The Indian government has issued a directive requiring smartphone manufacturers to pre-install official government applications on all devices sold in the country. The decision raises serious concerns around privacy, data collection, user autonomy, and broader digital sovereignty implications.

Don’t Think – Patch Now!

Sources:
01net – Raspberry Pi Price Increase
https://www.01net.com/actualites/hausse-des-couts-raspberry-pi-na-pas-dautre-choix-que-daugmenter-les-prix-de-ses-petits-ordinateurs.html

BleepingComputer – Coupang Data Breach
https://www.bleepingcomputer.com/news/security/retail-giant-coupang-suffers-data-breach-impacting-337-million-people/

CyberPress – Advanced Steganography
https://cyberpress.org/advanced-steganography/

The Hacker News – India Orders Pre-Installed Apps
https://thehackernews.com/2025/12/india-orders-phone-makers-to-pre.html

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

Mattermost Patches Silent Security Flaw
CERT-FR reports an "unspecified security issue" in Mattermost Server (MMSA-2025-00545). While technical details remain undisclosed by the vendor, the vulnerability impacts multiple branches including 10.11, 10.12, 11.0, and 11.1. Given the platform's role in centralizing sensitive internal communications, administrators are urged to apply the November 27th updates immediately.

Security Policy Bypass in Stormshield VPN Client
A logic flaw identified as CVE-2025-11955 affects the Stormshield Network VPN Client (v7.5.109). This vulnerability allows local users or attackers to bypass security policies enforced by the administrator, effectively neutralizing network restrictions and compliance rules on the endpoint.

VMware Tanzu & Stemcells Massive Security Overhaul
VMware has released a critical sweep of updates for Tanzu Platform and Ubuntu Stemcells (Jammy/Noble) to address a massive backlog of vulnerabilities dating as far back as 2022. Running outdated builds exposes application workloads to dozens of known CVEs, requiring an immediate upgrade to the November 30th releases.

Critical RCE and DoS Vulnerabilities in Zabbix
Zabbix has issued alerts for severe vulnerabilities affecting both Agents (specifically on AIX) and Servers across versions 6.0 through 7.4. The flaws expose infrastructure to Arbitrary Code Execution, Denial of Service, and security bypass. Due to the high privileges and visibility of monitoring systems, this is a critical priority for patching.

Don’t Think – Patch Now !

Listen to the full show here

Sources: 

CERT-FR – Mattermost Advisory https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1052/

CERT-FR – Stormshield VPN Advisory https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1053/

CERT-FR – VMware Tanzu Advisory https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1054/

CERT-FR – Zabbix Advisory https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1055/

Your feedback is welcome. 

Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

Cato CTRL Discloses "HashJack" Prompt Injection Cato Networks has revealed a new indirect prompt injection technique called "HashJack" that hides malicious payloads within URL fragments. This method blindsides perimeter WAFs but is fully processed by client-side AI browsers like Copilot and Gemini, enabling zero-click data exfiltration and callback phishing.

Superbox Android Devices Linked to BadBox 2.0 Botnet
KrebsOnSecurity reports that "Superbox" streaming devices are shipping with pre-rooted firmware and backdoors connecting to Tencent infrastructure. These devices serve as residential exit nodes for the IPidea proxy network, facilitating ad fraud and credential stuffing attacks on a massive scale.

Active Exploitation of Critical GeoServer Vulnerability
The Canadian Centre for Cyber Security warns of active exploitation of CVE-2025-58360 in GeoServer. This critical vulnerability allows for unauthenticated remote code execution (RCE) via GeoTools and GeoWebCache components, requiring immediate patching for all GIS administrators.

Postfix Vulnerability Allows Security Policy Bypass
CERT-FR has issued an advisory regarding a logic flaw in the Postfix mail transfer agent. The vulnerability allows remote attackers to circumvent configured SMTP restrictions and access maps. Updating to versions 3.10.6, 3.9.7, or 3.8.13 is mandatory to restore message filtering integrity.

UK NCSC Launches Cyber Action Toolkit for SMBs
The NCSC has released a new toolkit designed to help organizations with fewer than 50 employees secure their digital assets. For enterprise CISOs, this framework serves as a strategic asset to enforce basic hygiene standards within the upstream supply chain.

Don’t Think – Patch Now !

Sources:

• Cato Networks – HashJack https://www.catonetworks.com/blog/cato-ctrl-hashjack-first-known-indirect-prompt-injection/
• KrebsOnSecurity – Android TV Botnet https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/
• Canadian Centre for Cyber Security – GeoServer Alert https://www.cyber.gc.ca/fr/alertes-avis/bulletin-securite-geoserver-av25-789
• CERT-FR – Postfix Advisory https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1040/
• NCSC – SMB Toolkit https://www.ncsc.gov.uk/blog-post/time-small-businesses-act

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

CVSS v4.0 – Understanding the New Vulnerability Scoring Model
A new analysis from Malwarebytes provides a clear breakdown of CVSS v4.0, detailing how the updated framework shifts focus toward exploitability, environmental modifiers, and attacker utility. The article highlights changes in severity interpretation, granularity in attack requirements, and the impact of supplemental metrics—key for vulnerability prioritization across CERT, SOC, and risk teams.

Tomiris Deploys New Malware Tools
Kaspersky researchers have identified new components in the Tomiris malware ecosystem, including updated loaders and covert communications modules. These additions reinforce Tomiris’ operational overlap with Turla-linked activity while demonstrating improvements in stealth, modularity, and long-term persistence tactics used across Central Asian and Middle Eastern networks.

CISA Adds New KEV Entry
CISA has added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The advisory stresses active exploitation in the wild and mandates federal agencies to apply mitigation measures before the deadline. The alert underscores CISA’s continued emphasis on exploitation-based risk scoring and operational directives for rapid patching.

Legacy Python Bootstrap Scripts Create Supply Chain Exposure
A report from The Hacker News warns that outdated Python bootstrap scripts used in legacy automation pipelines can introduce severe supply chain weaknesses. The issue stems from insecure dependency retrieval mechanisms, outdated hashing practices, and implicit trust in remote package sources—raising the risk of tampering and malicious code injection in CI/CD environments.

Don’t Think – Patch Now.

Sources:

• Malwarebytes – CVSS v4.0 -  https://www.malwarebytes.com/blog/news/2025/11/how-cvss-v4-0-works-characterizing-and-scoring-vulnerabilities
• Securelist – Tomiris - https://securelist.com/tomiris-new-tools/118143/
• CISA – KEV Catalog Update - https://www.cisa.gov/news-events/alerts/2025/11/28/cisa-adds-one-known-exploited-vulnerability-catalog
• The Hacker News – Python Bootstrap Risk - https://thehackernews.com/2025/11/legacy-python-bootstrap-scripts-create.html

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

CISA & Commercial Spyware Targeting Messaging Apps
Following a joint alert by CISA, a technical breakdown reveals how multiple threat actors use QR-based session hijacking, zero-click exploits, and fake apps to compromise end-to-end encrypted messaging platforms such as Signal and WhatsApp. Victims include senior officials and civil society actors across the U.S., Europe, and the Middle East.

ORCA Initiative from Linux Foundation
The Linux Foundation has announced the creation of ORCA, a new Open Robust Compartmentalization Alliance aiming to promote memory safety and software isolation primitives. Key members include Microsoft, Google, Arm, and defense actors such as RTX and DARPA, focusing on securing toolchains for C, C++, and Rust.

Dell ControlVault2 & GL.iNet Flaws
Cisco Talos has disclosed vulnerabilities in Dell ControlVault2 and GL.iNet firmware affecting hardware security and OpenWRT-based VPN routers respectively. Exploits include heap overflows and race conditions. Patches are pending for multiple devices.

Poland Arrests Russian Hacker
Polish authorities have detained a Russian citizen linked to several intrusions against defense and public institutions. The individual is suspected of operating within a pro-Russian cybercriminal network supporting disinformation campaigns in Eastern Europe.

TOR Network Introduces Counter-Galois Encryption
The Tor Project is migrating from AES to a new encryption primitive called Counter-Galois (cgMul), developed specifically for onion-routing contexts. The move is intended to harden Tor nodes against speculative execution attacks and improve cryptographic agility.

Rey, Administrator of Scattered LAPSUS$ Hunters, Unmasked
KrebsOnSecurity has confirmed the identity of “Rey,” administrator of the Scattered LAPSUS$ Hunters Telegram channel and operator behind the ShinySp1d3r ransomware-as-a-service. Rey is a 15-year-old linked to past defacements and BreachForums activity. Despite claiming cooperation with law enforcement, he remains active within SLSH.

Don’t Think – Patch Now.

Sources:
CISA – Spyware & Messaging Apps
https://blog.marcfredericgomez.com/spyware-targeting-secure-mobile-messaging-applications/
 Linux Foundation – ORCA
https://www.linuxfoundation.org/press/linux-foundation-launches-the-open-robust-compartmentalization-alliance-orca-to-advance-software-security
 Cisco Talos – Dell / GL.iNet
https://blog.talosintelligence.com/dell-controlvault-lasso-gl-inet-vulnerabilities/
The Record – Arrest in Poland
https://therecord.media/poland-detains-russian-citizen-accused-of-hacks
 BleepingComputer – Tor Encryption Update
https://www.bleepingcomputer.com/news/security/tor-switches-to-new-counter-galois-onion-relay-encryption-algorithm/
 KrebsOnSecurity – SLSH / Rey
https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

CERT-FR: Advisory 2025-AVI-1042
CERT-FR has issued a new advisory describing several critical vulnerabilities impacting Gitlab.

RomCom via SocGholish
Arctic Wolf reports a campaign in which the RomCom threat group leveraged the SocGholish delivery infrastructure for the first time to deploy a targeted Mythic loader. The intrusion targeted a U.S. company indirectly connected to Ukraine, highlighting the evolving infection chains associated with GRU Unit 29155.

ShadowV2 IoT Botnet
Fortinet has analyzed ShadowV2, a Mirai-based IoT botnet observed exclusively during the major AWS outage in October. The botnet exploited at least eight vulnerabilities across devices from D-Link, TP-Link, DigiEver, TBK, and others. Activity targeted routers, NAS systems, and DVRs across multiple sectors, with global impact.

Don’t Think – Patch Now !

Sources:
CERT-FR – 2025-AVI-1042
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1042/

Arctic Wolf – RomCom / SocGholish https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/

BleepingComputer – ShadowV2 Botnet https://www.bleepingcomputer.com/news/security/new-shadowv2-botnet-malware-used-aws-outage-as-a-test-opportunity/

Your feedback is welcome.
Email: [email protected]
Website: https://www.radiocsirt.com
Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

💻 JackFix: Fake Windows Update Malware – A new campaign is distributing the JackFix malware through fake Windows Update pop-ups, enabling payload execution and stealthy installation of persistent backdoors.

🇫🇷 CERT-FR: PrimX Targeted – CERT-FR has issued an advisory detailing a compromise affecting PrimX, involving a vulnerability that allows security bypass and unauthorized access to protected data.

🐦 X / Twitter: Massive Internal Exposure – A misconfiguration at X exposed a wide range of internal metadata, service identifiers, and backend endpoints, revealing the scale of the platform’s internal systems.

🇷🇺 Russia & North Korea: Coordinated Operations – New reporting highlights increased collaboration between Russian and North Korean APT groups conducting joint cyber-espionage operations.

🍎 macOS: Flexible Ferret Malware – Fake LinkedIn job offers are being used to deliver Flexible Ferret, a macOS malware capable of stealing tokens, browser data and sensitive user information.

🛡️ Cobalt Strike 4.12 Released – The latest Cobalt Strike update includes hardened Beacon behavior, improved evasion techniques, and expanded support for offensive infrastructure setups.

🇷🇺 Russia: Tech Entrepreneur Arrested – Authorities have arrested a Russian tech entrepreneur on charges of treason, alleging that he transferred sensitive information to a foreign state.

📶 ASUS AiCloud: Critical Auth Bypass – ASUS warns of a critical authentication bypass affecting multiple AiCloud router models, allowing attackers to fully compromise affected devices.

🤖 NVIDIA DGX Spark: CVE-2025-33187 – A critical flaw (CVSS 9.3) in NVIDIA DGX Spark exposes AI model secrets and enables full system takeover due to a memory isolation failure.

📡 Huawei & State Surveillance – New analysis details how Huawei’s ecosystem supports large-scale surveillance capabilities through partnerships and integration in critical infrastructures.

🚨 OnSolve CodeRED: Emergency Alerts Down – A cyberattack on OnSolve has disrupted CodeRED emergency alert systems, preventing the broadcast of critical public safety notifications.

⚡ Don’t Think – Patch Now and ask later.

📚 Sources:

🔗 JackFix – The Hacker News
https://thehackernews.com/2025/11/jackfix-uses-fake-windows-update-pop.html

🔗 CERT-FR – PrimX
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1038/

🔗 X Exposure – Weaponized Spaces
https://weaponizedspaces.substack.com/p/x-just-accidentally-exposed-a-vast

🔗 Russia / North Korea Operations – CyberPress
https://cyberpress.org/russia-north-korea-hackers/

🔗 Flexible Ferret – Malwarebytes
https://www.malwarebytes.com/blog/news/2025/11/fake-linkedin-jobs-trick-mac-users-into-downloading-flexible-ferret-malware

🔗 Cobalt Strike 4.12 – CyberPress
https://cyberpress.org/cobalt-strike-4-12-released/

🔗 Russia Arrest – The Record
https://therecord.media/russia-arrests-tech-entrepreneur-treason

🔗 ASUS AiCloud – BleepingComputer
https://www.bleepingcomputer.com/news/security/asus-warns-of-new-critical-auth-bypass-flaw-in-aicloud-routers/

🔗 NVIDIA DGX Spark – SecurityOnline
https://securityonline.info/critical-patch-nvidia-dgx-spark-flaw-cve-2025-33187-cvss-9-3-exposes-ai-secrets-to-takeover/

🔗 Huawei Surveillance – Schneier
https://www.schneier.com/blog/archives/2025/11/huawei-and-chinese-surveillance.html

🔗 OnSolve CodeRED – Security Affairs
https://securityaffairs.com/185075/cyber-crime/emergency-alerts-go-dark-after-cyberattack-on-onsolve-codered.html

📞 Your feedback is welcome!
📧 Email: [email protected]
🌐 Website: https://www.radiocsirt.com
📰 Weekly Newsletter: https://radiocsirtintl.substack.com

Welcome to your daily cybersecurity briefing.

💸 FBI: Bank Impersonation Alert – The FBI reports that cybercriminals have stolen $262 million since January by impersonating bank support teams through sophisticated vishing and smishing campaigns.

📉 Microsoft: Exchange Online Outage – A major service disruption in North America is blocking access to Outlook mailboxes, caused by a configuration change that Microsoft is currently rolling back.

🐛 Supply Chain: Shai-Hulud Worm – A self-replicating worm has infected over 800 npm packages, modifying package.json scripts to exfiltrate AWS and GitHub secrets to external servers.

🦊 Mozilla: Critical Patch Released – Mozilla addresses CVE-2025-13016 in Firefox and Thunderbird, a critical vulnerability allowing remote code execution via malicious animation timelines.

🎓 Harvard: Vishing Data Breach – The university confirms a data breach exposing donor contact details after attackers impersonated IT support to gain remote control of an employee's workstation.

⚡ Don’t Think - Patch Now and ask later. 

📚 Sources: 

🔗 Bleeping Computer https://www.bleepingcomputer.com/news/security/fbi-cybercriminals-stole-262-million-by-impersonating-bank-support-teams-since-january/
🔗 Bleeping Computer (Microsoft) https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-online-outage-blocks-access-to-outlook-mailboxes/
🔗 Blog Marc-Frédéric Gomez https://blog.marcfredericgomez.fr/shai-hulud-un-ver-npm-infecte-plus-de-800-packages-et-exfiltre-des-secrets-sur-github/
🔗 HackRead https://hackread.com/update-firefox-patch-cve-2025-13016-vulnerability/
🔗 Security Affairs https://securityaffairs.com/185034/security/harvard-reports-vishing-breach-exposing-alumni-and-donor-contact-data.html

📞 Your feedback is welcome!
📧 Email: [email protected]
🌐 Website: https://www.radiocsirt.com
📰 Weekly Newsletter: https://radiocsirtintl.substack.com