TLDR INFORMATION SECURITY 2025-12-09

Download the free eBook

BARTS HEALTH NHS CONFIRMS CL0P RANSOMWARE BEHIND DATA BREACH

Barts Health NHS Trust confirmed that the Cl0p ransomware group exfiltrated 241 GB of data from invoice databases after exploiting a vulnerability in Oracle E-Business Suite. The breach occurred in August but remained undetected until data surfaced on leak sites in November. Stolen data included patient billing information, former staff salary records, and supplier payment details. Clinical systems remained unaffected. Oracle has since patched the exploited flaw. The incident highlights the continued targeting of healthcare organizations through enterprise software vulnerabilities.

CVE-2025-66516: MAXIMUM-SEVERITY VULNERABILITY IN APACHE TIKA COULD LEAD TO XML EXTERNAL ENTITY INJECTION ATTACK

A newly disclosed XXE vulnerability, CVE-2025-66516, affects several Apache Tika components and allows attackers to embed malicious XFA content in PDFs, potentially exposing sensitive server files or enabling remote code execution. Upgrade all affected Tika modules ASAP.

MALICIOUS VSCODE EXTENSIONS ON MICROSOFT'S REGISTRY DROP INFOSTEALERS

Researchers have discovered two malicious extensions for VSCode that masquerade as a theme and an AI assistant, respectively, to drop infostealers. The extensions run a script that uses curl to download a malicious DLL, which executes as runtime.dll. The infostealers collect running processes, clipboard content, WiFi credentials, system information, screenshots, lists of installed programs, cookies from Chrome and Edge browsers, and cryptocurrency wallet passwords and credentials.

OFFENSIVE SECURITY TAKES CENTER STAGE IN THE AI ERA

CISOs are increasingly adopting comprehensive offensive security programs as AI-enabled threats create more sophisticated attack patterns that traditional scanning cannot detect. OffSec maturity spans from basic vulnerability management through penetration testing to advanced threat hunting and security tool evasion testing. Automation and AI have lowered barriers to implementation. Offensive and defensive programs must work in concert rather than in isolation, with OffSec providing empirical risk validation and data-driven evidence for security investments.

HOW CAN RETAILERS CYBER-PREPARE FOR THE MOST VULNERABLE TIME OF THE YEAR?

Holiday shopping periods create compressed attack windows where bot-driven credential stuffing, account takeover, and automated fraud campaigns intensify against retail systems running at peak capacity with reduced staff. Layered defenses should include adaptive MFA for risky transactions, bot management with device fingerprinting, credential-stuffing detection, and blocking passwords against known breach datasets. Organizations should also test authentication failover procedures and implement strict third-party access controls, as vendor credential compromise remains a primary attack vector.

REACT2SHELL (CVE-2025-55182): DETECTION & MITIGATION GUIDE

React2Shell is a critical remote code execution flaw in React Server Components and related Next.js setups that allows an attacker to send a crafted HTTP request to a server-side function endpoint and execute arbitrary code on the backend. Systems are especially at risk when using React Server Functions with the use server directive or default Next.js App Router configurations, which expose vulnerable endpoints even in otherwise standard apps. The issue affects multiple React server DOM packages and a wide range of Next.js 15 and 16 versions. Fixed versions are already available. Upgrading these components is the primary mitigation.

GUARANTEE AN EXPLOIT-VALIDATED SECURITY FINDING OR YOU DON'T PAY. Watch how they completed a full pentest from launch to compliance-ready and get ready to start your own.

MALCONTENT

malcontent discovers supply-chain compromises through the magic of context, differential analysis, and 14k+ YARA rules.

NDPI

Open Source Deep Packet Inspection Software Toolkit.

RESEMBLE AI (PRODUCT LAUNCH)

Resemble AI builds enterprise voice-AI tools for ultra-realistic voice generation, cloning, and deepfake detection to secure communications and prevent AI-enabled fraud and social engineering attacks in real time.

ANDROID MALWARE FVNCBOT, SEEDSNATCHER, AND CLAYRAT GAIN STRONGER DATA THEFT FEATURES

Researchers disclosed three Android malware families with enhanced capabilities: FvncBot targets Polish banking users with keylogging, web-inject attacks, and hidden VNC; SeedSnatcher steals cryptocurrency wallet seed phrases and 2FA codes via Telegram distribution; and an upgraded ClayRat enables full device takeover through accessibility services abuse. FvncBot uses the apk0day crypting service and session-based installation to bypass Android 13+ restrictions, while ClayRat spreads through 25 phishing domains impersonating YouTube and Russian taxi apps. Organizations should monitor for accessibility service abuse patterns and enforce sideloading restrictions to mitigate these threats.

BLOCK ALL AI BROWSERS FOR THE FORESEEABLE FUTURE: GARTNER

Gartner analysts have urged organizations to block AI-enabled browsers, such as agentic and sidebar-based tools, because they send sensitive browsing data to cloud backends and can autonomously act within logged-in sessions, making them vulnerable to prompt injection, phishing, and credential abuse. They worry staff could automate mandatory tasks such as security training and misconfigure procurement or travel bookings, and have recommended strict risk assessments, tight controls, or outright bans for now.

GOOGLE DETAILS SECURITY MEASURES FOR CHROME'S AGENTIC FEATURES

Chrome's upcoming AI “agentic” features will act on users' behalf to complete tasks such as shopping or filling out forms, while also reducing security risks. It uses separate models to check that planned actions align with user goals and to vet URLs, limits what page data agents can read or modify, and asks for explicit permission before accessing sensitive sites, using passwords, or completing purchases.

24/7 support for critical issues. Try free for 30 days

RANSOMWARE PAYMENTS SURPASSED $4.5 BILLION: US TREASURY

Financial services, manufacturing, and healthcare were the most targeted sectors.

PORTUGAL UPDATES CYBERCRIME LAW TO EXEMPT SECURITY RESEARCHERS

Portugal established a legal safe harbor for good-faith security researchers who identify and responsibly disclose vulnerabilities without seeking economic benefit, provided they report findings to system owners and the national cybersecurity authority within strict guidelines.