Security News Roundup: 2025 in Review
2025 was the year security stopped being theoretical. Nation-state exploitation timelines compressed to hours. Cryptocurrency theft hit unprecedented scale. AI went from research curiosity to leaderboard champion. And contactless payment fraud went industrial.
No sponsored content. No vendor hype. Just the stories that mattered.
Critical Vulnerabilities
React2Shell (CVE-2025-55182) — CVSS 10.0
The web’s Log4Shell moment. Unauthenticated RCE in React Server Components via unsafe deserialization of the Flight protocol. Discovered November 29, disclosed December 3, exploited within hours. 39% of cloud environments affected. 8.1 million attack sessions recorded by GreyNoise. Over 30 organizations breached.
Read the full analysis in Article #1 of this issue.
Ivanti Connect Secure (CVE-2025-22457) — CVSS 9.0
Stack-based buffer overflow in Ivanti Connect Secure VPN gateways, exploited by China-nexus UNC5221 before patches were available. Initially assessed as a low-risk bug — later proven to be a remotely exploitable RCE. Affected thousands of enterprise VPN concentrators.
WARN
If you run Ivanti Connect Secure, verify you’re on a patched version immediately. This was actively exploited as a zero-day before disclosure.
Langflow AI RCE (CVE-2025-3248) — CVSS 9.8
A code injection vulnerability in Langflow, a popular visual framework for building AI/LLM applications. Unauthenticated attackers could execute arbitrary code on the server. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. A stark reminder that the rush to deploy AI tooling is creating new attack surfaces faster than they can be secured.
SharePoint ToolShell (CVE-2025-53770) — CVSS 9.8
Unauthenticated RCE in Microsoft SharePoint through insecure deserialization. Actively exploited against government and financial sector targets. Yet another deserialization-to-RCE pattern — 2025 was the year deserialization vulnerabilities went mainstream.
AirBorne — 23 AirPlay Vulnerabilities
Oligo Security disclosed 23 flaws in Apple’s AirPlay protocol, including zero-click wormable RCE (CVE-2025-24252 + CVE-2025-24206). Billions of devices affected, including third-party speakers and car systems that may never receive patches.
Read the full analysis in Article #4 of this issue.
Major Incidents
Bybit Heist: $1.5 Billion Stolen
DPRK’s Lazarus Group (TraderTraitor) stole 401,347 ETH from Bybit on February 21 via a supply chain attack on Safe{Wallet}. A developer’s laptop was compromised through social engineering, AWS session tokens were hijacked, and malicious JavaScript was injected into the wallet UI. The FBI attributed the attack within five days.
Read the full analysis in Article #2 of this issue.
AISURU 31.4 Tbps DDoS Record
In February 2026, Cloudflare mitigated a 31.4 Tbps distributed denial-of-service attack — the largest ever recorded. The AISURU botnet, composed of compromised IoT devices, launched the attack against a major gaming platform. The previous record (5.6 Tbps, also by AISURU) had stood for less than a year.
APT42 Deepfake Phishing
Iran’s APT42 (Charming Kitten) deployed Google Gemini to generate deepfake video and audio for phishing campaigns targeting journalists, diplomats, and human rights activists. The AI-generated content was used in video calls to impersonate known contacts. Google’s Threat Analysis Group documented the campaign and published IOCs.
Threat Trends
EtherHiding: Blockchain C2 Goes Nation-State
DPRK’s UNC5342 became the first nation-state actor to adopt EtherHiding — embedding C2 instructions in Ethereum and BNB Smart Chain smart contracts. The technique makes malware infrastructure effectively untakedownable: no domain to sinkhole, no server to seize, no hosting provider to contact.
Read the full analysis in Article #3 of this issue.
NFC Relay Fraud Explodes
NFC-based payment fraud surged 35x in H1 2025 (ESET telemetry). The weaponization of TU Darmstadt’s NFCGate research tool into criminal MaaS platforms (NGate, SuperCard X, Ghost Tap) has industrialized contactless payment fraud. Russian losses alone: 432 million rubles in Q1 2025.
Read the full analysis in Article #6 of this issue.
Rhysida Ransomware: Original Research
c0mmrade’s firsthand investigation into a Rhysida ransomware incident led to the discovery of exposed C2 infrastructure, identification of 14 additional victims through SOCKS proxy logs, and coordination with the FBI for forensic acquisition. The initial access vector: CVE-2024-55591 (Fortigate auth bypass).
Read the full analysis in Article #5 and the Phase 2 investigation in Article #10 of this issue.
AI in Security
XBOW Hits #1 on HackerOne
An autonomous AI pentesting agent submitted over 1,000 vulnerability reports and climbed to #1 on HackerOne’s US leaderboard in approximately three months. At Black Hat 2025, XBOW demonstrated live vulnerability discovery against production targets. The benchmark (104 challenges) is now open-source.
Read the full analysis in Article #8 of this issue.
AI Breaks Side-Channel Crypto
Deep learning models now recover AES keys from fewer than 50 power traces — even against masked implementations. Attacks on post-quantum cryptography (CRYSTALS-Kyber, Saber) achieved key recovery from as few as 16 traces, bypassing masking countermeasures through end-to-end learning.
Read the full analysis in Article #7 of this issue.
AI as Attack Surface
The proliferation of LLM-integrated applications created new vulnerability classes: prompt injection, training data extraction, and tool misuse. The Langflow RCE (CVE-2025-3248) exemplified the pattern — AI tooling deployed rapidly with insufficient security review.
By the Numbers
| Metric | Value |
|---|---|
| Largest crypto theft | $1.5B (Bybit) |
| Largest DDoS attack | 31.4 Tbps (AISURU) |
| React2Shell attack sessions | 8.1 million |
| AirPlay CVEs disclosed | 17 |
| NFC attack growth (H1 2025) | 35x |
| XBOW vulnerabilities submitted | ~1,060 |
| Chrome zero-day market price | $3M+ |
| Full iOS chain market price | $5M+ |
Looking Ahead to 2026
The trends are clear:
- Exploitation timelines are compressing. Hours between disclosure and exploitation is the new normal. “Patch Tuesday, Exploit Wednesday” has become “Patch, Exploit Same Day.”
- Supply chain attacks are maturing. The Bybit heist showed that targeting a developer’s laptop is more effective than targeting the platform directly.
- AI is reshaping both offense and defense. XBOW on offense, deep learning countermeasure evaluation on defense. The tools are available to both sides.
- Physical-layer attacks are going mainstream. NFC relay fraud went from research paper to MaaS platform in under two years. Side-channel attacks are following a similar trajectory.
- Blockchain infrastructure is being weaponized. Untakedownable C2, immutable malware hosting, pseudonymous operations. The tools of decentralization serve attackers as well as activists.
Stay informed. Stay paranoid. Stay patched.
See you in Volume 2.
-- r00t