If you read nothing else
- If your website runs on React or Next.js, ask your developer whether it is updated. A CVSS 10.0 flaw was attacked within hours.
- Patch Fortinet and WatchGuard firewalls. Both were exploited in December.
- Close a leaver's access the day they leave. A former employee is suspected in the year's biggest retail breach.
Six things from December 2025. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. A website framework flaw was attacked within hours
React2Shell, CVE-2025-55182 (CVSS 10.0), let an unauthenticated attacker run commands on servers using React Server Components, including Next.js sites. Fixed React versions are 19.0.1, 19.1.2 and 19.2.1. Amazon saw attack attempts from China-linked groups within hours of disclosure. Source: The Hacker News.
CISA added it to the Known Exploited Vulnerabilities list on December 5, with a December 12 deadline for federal agencies. Source: CISA KEV catalog.
What this means for you: your website or customer portal can be the way in, even if nobody on staff wrote code.
Do this: ask whoever built your website or portal, in writing, whether it uses React or Next.js and the date it was updated.
2. Firewalls were the front door again
Fortinet disclosed CVE-2025-59718 on December 9. From December 12, Arctic Wolf saw attackers log in to FortiGate devices through FortiCloud SSO and export the device configuration, which can include hashed passwords. CISA set a December 23 deadline for federal agencies. Source: Help Net Security, December 17.
WatchGuard said on December 18 that attackers were trying to exploit CVE-2025-14733, a flaw in Firebox VPN handling that can let an unauthenticated attacker run code. Shadowserver found more than 115,000 internet-facing Fireboxes that may be vulnerable. Source: Help Net Security, December 22.
What this means for you: the box that guards your network is the first thing attackers try.
Do this: ask your IT provider whether you run either product and the date each was patched. If it was attacked, change every password stored on it.
3. Microsoft fixed a Windows flaw already in use
December's Patch Tuesday on December 9 fixed 57 flaws. CVE-2025-62221, in the Windows Cloud Files Mini Filter Driver, was exploited as a zero-day and lets an attacker who already has a foothold gain SYSTEM rights. Source: BleepingComputer.
What this means for you: an attacker on one PC can use this to take over that PC completely.
Do this: on every Windows PC, open Settings, then Windows Update, install, restart, and check again until it says you are up to date.
4. A former employee is suspected in a 33.7 million account breach
Coupang, South Korea's largest online retailer, said personal data from about 33.7 million accounts was exposed, starting June 24. Police identified a former employee as a suspect. Source: Security Affairs, December 2.
What this means for you: access that outlives a job is a risk, at any size.
Do this: keep a leaver checklist: disable accounts, revoke keys and remote access, and change shared passwords on the person's last day.
5. Hackers took data from university finance software
The University of Pennsylvania said attackers used a zero-day in Oracle E-Business Suite, CVE-2025-61882, to take personal data from the system it uses for supplier payments and the general ledger. The Clop group has been raiding Oracle EBS systems since August. Source: The Register, December 2.
What this means for you: your finance and ERP systems hold supplier and employee data attackers want.
Do this: ask the vendor of your accounting or ERP software whether a security update is pending, and install it.
6. A subcontractor's account opened customer records
Canadian carrier Freedom Mobile said a third party used a subcontractor's account to reach its customer management platform and view names, addresses, dates of birth and phone numbers. Source: MobileSyrup, December 4.
What this means for you: the people you let into your systems are part of your attack surface.
Do this: require MFA on every outside account, give each one only the access it needs, and remove it when the job ends.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.