Digital Ninjas Lurking! PLA Hacks Spike 150%, React2Shell Rocks Feds, iPhone Secrets Swiped

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on Digital Frontline, your daily dive into China's cyber chess moves against US turf. Buckle up—over the past 24 hours, the Pentagon's fresh 2025 report to Congress dropped a bombshell: Chinese cyberattacks spiked over 150% in 2024, with Salt Typhoon hackers burrowing into nine major US telcos like AT&T and Verizon, lurking up to two years for potential wartime sabotage. According to the US Department of War's assessment, these PLA-linked ops, including Volt Typhoon variants, hit critical infrastructure hard—think transportation in Seattle, energy grids, water utilities, and even edge devices like traffic lights that haven't seen a security patch since the dial-up era. New threats? CISA just flagged React2Shell, a CVSS 10.0 zero-day in Meta's React Server Components—CVE-2025-55182—letting unauthenticated creeps execute code. Chinese actors pounced within hours, dropping cryptominers and backdoors on federal and private nets; patch by yesterday or you're toast. Meanwhile, MongoBleed, that nasty CVE-2025-14847 memory leak in MongoDB, is bleeding creds from 42% of cloud setups—self-hosted ones are sitting ducks. And get this: hackers just hammered an unnamed Apple assembler in China—likely Foxconn, Pegatron, or Wistron—exposing iPhone production secrets mid-December, per DigiTimes. Clients are sweating supply chain chaos, echoing TSMC's 2018 virus shutdown. Targeted sectors? Telecom's ground zero, but FinanceWire reports 300% surge in hits on financial services, manufacturing, and industrial controls—70% of 2024 attacks nailed critical infra across 44 states. Senate probes show Salt Typhoon exploited ancient gear in water systems and utilities, positioning for crisis disruption. Expert take: Defence Industry Europe's Martin Chomsky nails it—the PLA's "national total war" doctrine eyes Taiwan by 2027, with cyber as the sneaky opener to cripple US Pacific ops. Pentagon warns Beijing's now a homeland threat across domains, from YJ-21 hypersonics to space jammers. Defensive playbooks, folks: CISA, NSA, FBI scream multi-factor everywhere—no more password roulette amid that 16-billion-cred mega-leak buffet. Audit FortiGate SSO for CVE-2025-59718 bypasses, segment legacy IoT with 256-bit MACsec like Actelis Networks is doing for DC traffic cams and German utilities. Hunt anomalies via AI-driven tools, enforce SBOMs post-Nissan-Red Hat mess, and air-gap prod lines. Businesses, rotate creds, hunt for React2Shell RCE, and simulate Salt Typhoon evictions—assume they're inside. Stay sharp, encrypt the edges, and don't let Xi's digital ninjas turn your lights out. Thanks for tuning in, listeners—subscribe for tomorrow's intel drop. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.