InfosecFISH

[NCSC UK @NCSC]

Today, we have set out our key judgements on how AI is expected to affect cyber security.

Read the latest:
https://t.co/2kjEN3dJSh

[WarMonitor🇺🇦🇬🇧 @WarMonitor3]

BREAKING: Europe is under a massive widespread cyber attack right now Sweden, Belgium, Luxembourg, Estonia, Ireland the Netherlands and just now Finland are all experiencing disruptions to supermarket refrigeration systems causing food to go off.

The attack is spreading...

[Dr. Kitze ❤️ healthmaxx.app @thekitze]

beautiful explanation. this is 100% happening. https://t.co/637WwcoLwQ

[John Hultquist @JohnHultquist]

Poland releases details on December’s cyberattack on their energy infrastructure, noting similarities to prior FSB activity. The wiper has been attributed by others to Sandworm (GRU). Attribution is definitely not super clear yet. 1/x

[International Cyber Digest @IntCyberDigest]

‼️🇨🇳 BREAKING: China not only breached US but also UK wiretapping systems, gaining access to phone calls, text messages, and cell phone locations

Chinese state hackers exploited backdoors that carriers are required to implement for government access.

For about four years, the hackers could see not only who British officials were calling, but also whom the FBI was investigating, which Chinese operatives were under surveillance, what the United States knew about Beijing’s activities, and when counterintelligence was closing in.

They could geolocate millions of individuals, record phone calls at will, and compromise the surveillance of their own surveillers—achieving the counterintelligence equivalent of reading the opponent’s playbook during the game.

[The Hacker News @TheHackersNews]

🛑 URGENT: Microsoft rushed out out-of-band fixes for an actively exploited Office zero-day.

CVE-2026-21509 (CVSS 7.8) lets attackers bypass Office security using a malicious file that must be opened by the victim.

🔗 Details → https://t.co/a7QFT8PJPw

[CISA Cyber @CISACyber]

🤖 AI can enhance efficiency in #CriticalInfrastructure sectors but also introduces risks to models, networks, data, and users. Our 🆕 guidance, developed with @ASDGovAU & partners, helps CI owners and operators manage these risks and more. Check it out 🔗 https://t.co/u79kapcKLk

[Wiz @wiz_io]

🚨 CRITICAL RCE ALERT: React & Next.js Vulnerability ↓

Critical remote code execution (RCE) vulnerabilities have been published affecting the React 19 ecosystem and Next.js.

These vulnerabilities (CVE-2025-55182 & CVE-2025-66478) reside in the React Server Components (RSC) "Flight" protocol. They allow unauthenticated attackers to execute arbitrary code on the server by sending a specially crafted HTTP POST request.

→ Severity: Critical.
→ Vector: Remote, Unauthenticated.
→ Success Rate: Near 100% in default configurations.
→ Affected: Standard deployments of Next.js (App Router) and React 19.

🟢 Immediate action required: Patch. There are no workarounds other than patching. Security teams must prioritize upgrading dependencies to hardened versions immediately.

—

Read our full technical breakdown and remediation guide here: https://t.co/hVstCUpUnr

[BleepingComputer @BleepinComputer]

Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets - @billtoulas
https://t.co/ijQ3c7qzY7

https://t.co/ijQ3c7qzY7

[The Hacker News @TheHackersNews]

⚠️ URGENT: A 10.0-severity bug just hit React Server Components and Next.js.

It lets anyone run code on your server — even without logging in.

🔗 Details → https://t.co/9pG1bxMlCw

⚙️ Fix: update to patched versions now.

[NCSC UK @NCSC]

ACCESS DENIED: Almost 1 billion attempts to access malicious websites blocked🚨

The NCSC's Share and Defend capability enables the rapid disruption of fraud and early-stage cyber attacks

🧵

[The Hacker News @TheHackersNews]

🔥 New npm attack DETECTED!

A campaign dubbed “Sha1-Hulud: The Second Coming” has compromised hundreds of packages and over 25,000 GitHub repos.

The code runs during install, steals cloud logins, and if that fails, it deletes the user’s home folder.

Read more ↓ https://t.co/gNo00gZW3B

[Dark Web Informer @DarkWebInformer]

Can Nudge Security or someone with free time, create a website dedicated to the Gainsight breach? Similar to this website on the Salesloft breach: https://t.co/co1rPcjhqB. It was pretty helpful.

[InfosecFISH @InfosecFish]

https://t.co/wO6vNUGanT

[InfosecFISH @InfosecFish]

https://t.co/COFafU6Ubw

[InfosecFISH @InfosecFish]

https://t.co/x6joMj8Ef3

[InfosecFISH @InfosecFish]

#StopRansomware: Akira Ransomware https://t.co/x2Pm73lGQY

[The Hacker News @TheHackersNews]

🚨 CISA says hackers are exploiting a serious WatchGuard firewall flaw (CVE-2025-9242, score 9.3).

Attackers can run code without logging in.

Over 54,000 Firebox devices are still exposed. Patch before Dec 3.

Details ↓ https://t.co/mUvnNWSANZ

[Mandiant (part of Google Cloud) @Mandiant]

Mandiant Threat Defense recently observed exploitation of CVE-2025-12480, which gives threat actors unauthenticated access on Gladinet’s Triofox platform. Learn about the threat, and get IOCs to defend against it.

📄 Read more: https://t.co/vbg8yHNCTX