InfoSecBulletin Cybersecurity for mankind

A financially motivated ransomware gang exploited React2Shell vulnerability (CVE-2025-55182) to quickly access corporate networks and deploy malware less than a minute later. React2Shell (CVE-2025-55182) is a maximum severity vulnerability in React Server Components (RSC) which was publicly disclosed on 3 December 2025. The vulnerability impacts the Flight Protocol, a core …

CISA has listed a critical zero-day vulnerability affecting various Apple products in its Known Exploited Vulnerabilities catalog, indicating it is being actively exploited. CVE-2025-43529 is a severe use-after-free vulnerability in WebKit, Apple’s rendering engine, affecting millions of users on iOS, iPadOS, macOS, and other Apple platforms. A use-after-free vulnerability (CWE-416) …

At least 17 Firefox extensions managed to evade detection by hiding malware in their icons. Thousands of users have been compromised, and these harmful add-ons remain accessible on the Firefox platform. Koi Security found 17 Firefox extensions that look safe, with no visible malicious scripts. They offer services like “free …