Published: December 28, 2025 | Severity: Critical (CVSS 8.7) | Status: Actively Exploited A severe memory leak vulnerability in MongoDB Server has been disclosed, allowing unauthenticated attackers to remotely extract sensitive data from vulnerable instances. Dubbed "MongoBleed" (CVE-2025-14847), the flaw has already been exploited in the wild with over
Executive Summary: Ubisoft faces dual security crises as Rainbow Six Siege remains offline following a devastating December 27, 2025 breach that flooded players with billions in premium currency—while VX-Underground simultaneously reveals that outsourced helpdesk staff have been accepting bribes for panel access since 2021. The combination exposes catastrophic failures
As organizations powered down for the holidays, threat actors ramped up operations—Qilin, Akira, The Gentlemen, and emerging groups capitalize on reduced staffing December 28, 2025 While most of the world was unwrapping presents and recovering from holiday festivities, ransomware operators were busy unwrapping something else entirely: corporate networks. Between
How a cybersecurity incident at one of Wall Street's most prestigious law firms exposed the uncomfortable truth about third-party risk in the professional services sector Executive Summary On December 19, 2024, Goldman Sachs Group Inc. sent a letter that no financial institution wants to write: informing investors in
France's domestic intelligence agency has taken over the investigation into a massive cyberattack that crippled the country's national postal service during the critical Christmas delivery period, after pro-Russian hacktivist group NoName057(16) claimed responsibility for the coordinated campaign targeting French critical infrastructure. DGSI Takes Lead in
The Department of Justice just demonstrated what happens when document security meets government incompetence. In one of the most anticipated document releases in recent memory, the DOJ's December 19th dump of Jeffrey Epstein investigation files contained a security flaw so fundamental it belongs in a first-week InfoSec 101
Breaking Analysis: 300GB Data Breach Affects Technology Provider for 2,000 UK GP Practices Executive Summary DXS International, a UK-based healthcare technology provider serving approximately 2,000 GP practices overseeing the care of 17 million patients, has disclosed a ransomware attack that compromised office servers and resulted in the alleged
Danish intelligence reveals coordinated campaign by pro-Russian hacking groups in latest escalation of hybrid warfare tactics Executive Summary Denmark's Defence Intelligence Service (DDIS) publicly attributed two significant cyber-attacks to Russian state-connected actors on December 18, 2025, marking another escalation in Russia's hybrid warfare campaign against Western
A Business Email Compromise attack likely behind financial losses as municipal cybersecurity crisis deepens nationwide The City of Westminster, South Carolina discovered on Wednesday, December 11, 2025, that portions of its information technology systems had been compromised in a cyber attack that resulted in the theft of public funds. While
Critical postal and banking services knocked offline just 72 hours before Christmas as France faces unprecedented wave of cyberattacks targeting government and critical infrastructure Executive Summary France's national postal service La Poste and its banking subsidiary La Banque Postale suffered a devastating distributed denial-of-service (DDoS) attack on Monday,
Senator Tom Cotton warns that China and Russia are systematically exploiting trust-based OSS ecosystem to compromise U.S. defense systems December 20, 2025 — In a stark warning to the nation's top cybersecurity official, Senate Intelligence Committee Chairman Tom Cotton has outlined what he calls a "critical national
As Cl0p's Higher Education Rampage Continues, Two More Institutions Face the Consequences of Enterprise Software Vulnerabilities December 19, 2025 Executive Summary The University of Phoenix and Baker University have become the latest educational institutions to confirm breaches stemming from the exploitation of CVE-2025-61882—the Oracle E-Business Suite zero-day
A comprehensive analysis of 348 cyber attacks detected across the global threat landscape from December 12-19, 2025 Executive Summary The week of December 12-19, 2025 has shattered expectations for the traditional holiday cybersecurity slowdown. Instead of the anticipated decrease in attack activity, threat intelligence monitoring detected 348 distinct ransomware and
From ransomware negotiators to exploit developers to federal contractors, 2025 exposed a disturbing pattern of trusted security professionals weaponizing their access against the very organizations they were hired to protect. December 19, 2025 Executive Summary The year 2025 will be remembered as a watershed moment in cybersecurity history—not for
Two former cybersecurity professionals have pleaded guilty to orchestrating ransomware attacks against U.S. companies, marking a stunning betrayal of trust in an industry built on protecting organizations from cyber threats. December 19, 2025 Executive Summary Ryan Clifford Goldberg and Kevin Tyler Martin, two former employees of cybersecurity incident response
Amazon measuring deviations in employee keystroke times from pre-established baselines probably shouldn't surprise us at this point. Seems on brand, actually. But what caught my attention wasn't the monitoring itself—it was how 110 milliseconds became the thread that unraveled an entire North Korean intelligence operation.
Bottom Line Up Front: Amazon's threat intelligence team has exposed a critical evolution in Russian state-sponsored cyber operations: APT44 (Sandworm) has shifted from expensive zero-day exploitation to targeting misconfigured network edge devices as their primary attack vector against Western energy and critical infrastructure. This tactical pivot—tracked across
December 19, 2025 - In one of the most significant financial cybercrime cases to date, federal prosecutors have charged 54 individuals connected to Tren de Aragua (TdA), a designated foreign terrorist organization, with orchestrating a sophisticated nationwide ATM jackpotting operation that netted over $40.73 million as of August 2025.
A comprehensive analysis of the data breaches, ransomware campaigns, and privacy failures that exposed billions of records and reshaped the cybersecurity landscape The Year Privacy Became a Luxury Another year has ended, and with it, thousands of data breaches affecting hundreds of millions of people. The question in 2025 was
The country that wrote the playbook on digital identity had its homework stolen In July 2021, a Tallinn-based hacker exploited a vulnerability in Estonia's Identity Documents Database (KMAIS) and walked away with government ID photos of 286,438 citizens. The breach was particularly embarrassing because Estonia isn'
OpenAI, the company behind ChatGPT, faces an unprecedented convergence of crises in December 2025. Within weeks, the AI giant disclosed a third-party data breach affecting its API users, was ordered by a federal court to hand over 20 million private ChatGPT conversations to The New York Times, and became defendant
On November 8, 2025, analytics giant Mixpanel fell victim to a sophisticated SMS phishing attack that would ultimately expose customer data across hundreds of major organizations—from OpenAI and PornHub to SoundCloud and cryptocurrency platforms. The breach highlights critical vulnerabilities in the analytics industry, where third-party providers collect massive amounts
The adult entertainment platform PornHub is being extorted by the notorious ShinyHunters hacking group following the theft of over 200 million Premium member activity records. The breach, which both parties attribute to a recent compromise at analytics provider Mixpanel, has exposed highly sensitive user data including detailed viewing histories, search
December 12, 2025 - In a stark escalation of cyber tensions, Germany has formally accused Russia's military intelligence agency of orchestrating a sophisticated cyber-attack against its air traffic control systems, joining a growing chorus of nations confronting an unprecedented wave of digital assaults targeting aviation infrastructure worldwide. The