Record-breaking DDoS attack
Aisuru just broke the DDoS record again, firing off a massive 29.7-terabit-per-second attack that Cloudflare had to absorb. This botnet is basically a rentable army of up to four million hacked routers and IoT devices, and it’s been hammering targets all year. Cloudflare says nearly half of those attacks are now “hyper-volumetric,” and one recent wave even disrupted parts of the U.S. internet despite not being the intended target.
React bug puts servers at risk
A maximum-severity vulnerability in React Server Components (CVE-2025-55182) could let attackers run arbitrary code on servers without authentication. The flaw affects apps using React Server Function endpoints and even Next.js with App Router, as well as libraries bundling RSC like Vite, Parcel, and RedwoodJS. Researchers say nearly 40% of cloud environments may be exposed.
RansomHouse attack cripples retailer
Japan’s Askul is finally getting back online six weeks after a ransomware attack forced companies to order supplies by fax. The Japanese retailer (think Staples meets Amazon for office goods) has reopened limited online sales for corporate customers and says it’ll gradually restore its full catalog.The RansomHouse attack exposed customer and supplier data and disrupted supply chains for brands like Muji, which later confirmed its own customer data was affected. It’s the latest in a wave of major ransomware hits on Japanese companies, including Asahi, which is still recovering months later.
Ransomware payment denied, unless…
The UK government is moving forward with a proposed ban on ransomware payments for public sector and critical national infrastructure organizations, with national security exemptions to avoid life-or-death dilemmas, says Security Minister Dan Jarvis. The legislation would also require other businesses to notify authorities if they plan to pay a ransom. Jarvis called the current system “not sustainable” and is consulting across government, CNI organizations, and allies in the Five Eyes and G7 to ensure the ban is effective and workable.
Huge thanks to our sponsor, Vanta
It’s not just the Ivys… University of Phoenix hit by Clop
The University of Phoenix has joined the elite ranks of Harvard and UPenn, all targeted in Clop’s ongoing ransomware campaign. Attackers exploited a zero-day in Oracle E-Business Suite in August 2025, stealing sensitive personal and financial data from students, staff, and suppliers. Phoenix detected the breach after being added to Clop’s data leak site and is notifying affected individuals.
Android expands in-call scam protection
Google is expanding its in-call scam protection on Android to cover popular U.S. banking and fintech apps, including Cash App and JPMorgan Chase. The feature warns users when an unknown caller tries to manipulate them into sharing their screen or banking info, showing a 30-second alert that can only be dismissed by ending the call. Originally piloted in the U.K., the system now aims to protect Android 11+ users in the U.S. from social engineering attacks that exploit urgency and panic to steal money or sensitive information.
Another critical WordPress plugin vulnerability
A serious flaw in the King Addons for Elementor plugin (CVE-2025-8489, CVSS 9.8) is being actively exploited, allowing attackers to grant themselves admin privileges on vulnerable sites. The bug affects versions 24.12.92 through 51.1.14 and was patched in version 51.1.35 on September 25, 2025. Since disclosure, over 48,000 exploit attempts have been observed, with attackers using the vulnerability to potentially take full control of affected websites.
(Security Week), (The Hacker News)
Microsoft silently mitigates zero-day
Microsoft has quietly addressed CVE-2025-9491, a high-severity Windows LNK vulnerability. Both state-backed hackers and cybercriminal groups are using this flaw to sneak in malware like Ursnif, Gh0st RAT, and Trickbot. In November updates, Microsoft quietly made a change: now when you check a shortcut’s properties, you can see the full “Target” field (where the hidden command is). Even with Microsoft’s update, the hidden malicious commands still exist, and Windows doesn’t warn users when they click a dangerous shortcut. So it’s not a full fix.