RadioCSIRT - Your Cybersecurity Update for Friday, 5 December 2025 (Ep.41)

Welcome to your daily cybersecurity briefing.Cloudflare has attributed today's major service outage to the deployment of an emergency patch intended to mitigate the critical "React2Shell" vulnerability. The incident highlights the delicate balance between security responsiveness and operational stability: the attempt to rapidly mitigate an active flaw resulted in a global software regression, serving as a stark reminder that even the most robust infrastructures remain vulnerable to the side effects of precipitated updates.CISA has updated its Known Exploited Vulnerabilities (KEV) catalog and simultaneously released technical analysis report AR25-338a. This new entry imposes a strict remediation timeline for federal agencies, signaling active exploitation in the wild. The associated report provides defenders with crucial Indicators of Compromise (IoCs) and observed tactics, which are indispensable for strengthening detection and response against this specific threat.CERT-FR, the French National Cybersecurity Agency, has issued a security advisory regarding multiple vulnerabilities affecting the PostgreSQL database management system. These flaws, if exploited, could allow a remote or local attacker to compromise data confidentiality and integrity, or trigger a denial of service. Database administrators are urged to apply security patches without delay to protect production instances.The "smishing" landscape is evolving dangerously as the holiday season approaches, according to an analysis by Brian Krebs. Cybercriminals are gradually pivoting away from classic package delivery lures to focus on more targeted scenarios, such as expiring loyalty points, fake tax adjustments, and online retailer impersonation. This shift toward financial and administrative pretexts aims to maximize click-through rates by leveraging urgency and the fear of financial loss.Don’t Think – Patch Now! Sources:https://www.bleepingcomputer.com/news/security/cloudflare-blames-todays-outage-on-emergency-react2shell-patch/https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-cataloghttps://www.cisa.gov/news-events/analysis-reports/ar25-338ahttps://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1061/https://krebsonsecurity.com/2025/12/sms-phishers-pivot-to-points-taxes-fake-retailers/Your feedback is welcome.Email: [email protected]:https://www.radiocsirt.comWeekly Newsletter:https://radiocsirtintl.substack.com