The security world isn’t slowing down, Digital Defenders. |
Today brings quiet patches with loud implications, updates that can’t be undone, accounts cracking under pressure, botnets drifting into new waters, and cloud keys that refuse to stay dead. |
|
|
Here’s what you need to know: |
|
|
Critical RCE Bugs Hit SAP Platforms |
SAP’s December 2025 update delivers critical fixes for Solution Manager, Commerce Cloud, NetWeaver, and jConnect, including three CVSS 9.0+ flaws that allow arbitrary code execution.
The vulnerabilities include CVE-2025-42880 that enables low-privilege attackers to inject code, escalate access, and move laterally across integrated SAP systems. |
SAP has released patches for the vulnerabilities.
Apply critical SAP patches promptly, harden access controls, segment and monitor your environment, and maintain strong backup and incident-response processes. |
Windows 11 Gets Major WinRE Fix in Silent Rollout |
Microsoft has released a critical Windows 11 update that strengthens the Windows Recovery Environment, which is essential for restoring systems after boot failures or update issues.
Because WinRE changes are permanent and non-reversible, organizations with strict change-control processes will need to adjust their governance and monitoring.
Review your Windows 11 update policies, verify WinRE versions across devices, and update governance and monitoring processes to account for permanent, non-reversible recovery environment changes. |
Google Flags Surge in Chrome Account Takeovers |
A surge in account takeover attacks has prompted Google to issue a warning to Chrome users as credential theft, session hijacking, and cookie-based compromises continue to climb. With Chrome Sync storing passwords and payment data, a single compromised Google account can expose an entire digital footprint.
Although Google is adding protections like Workspace passkeys and Device Bound Session Credentials, attackers are escalating just as quickly amid rising phishing and infostealer activity. Review your Chrome Sync settings, enable passkeys and strong MFA, and limit what data is synced to reduce the impact of potential account takeovers. |
|
|
How confident are you in your defenses against account takeovers? |
|
|
Yesterday's Pulse Check Results |
If attackers hijack your tools, what do you do first? |
|
|
Security Tools You Can Use |
-
Protect your data with security tools that spot and stop threats instantly.
- Find hidden vulnerabilities fast with platforms that reveal risks before attackers strike.
-
Whether you’ve explored DZone already or not, we’d love your feedback in our Community Survey.
|
|
|
Botnet Targets Ships in Stealthy DVR Attack |
A new Mirai variant called Broadside is exploiting a critical DVR flaw to gain persistent access to maritime networks and launch high-volume DDoS attacks.
Unlike traditional Mirai strains, Broadside adds credential harvesting, in-memory execution, lateral movement, and process tampering — posing serious risks for vessels running flat OT networks with limited bandwidth. |
Source: Nordli Mathisen/Unsplash |
Patch vulnerable DVRs, segment maritime OT networks, enhance monitoring for Broadside indicators, harden embedded devices, and routinely audit camera systems for suspicious activity. |
AWS IAM Gap Lets Attackers Reclaim Cloud Access |
A newly documented AWS IAM persistence technique shows attackers can briefly maintain or regain cloud access even after defenders delete compromised access keys.
Because IAM uses an eventually consistent architecture, key and policy changes take seconds to propagate, creating a brief window where outdated permissions still work. Use organization-level SCPs, rely on temporary credentials, automate deny-all responses, monitor for suspicious IAM polling, and pair AWS’s cleanup procedure with SCP enforcement to prevent attackers from exploiting propagation delays. |
|
|
Legacy ITSM is holding teams back. On December 16 at 1:00 PM ET, join TechnologyAdvice × Freshworks for Straight from the Source: ITSM Customers Who Switched. Hear real stories from IT teams who’ve modernized with AI-powered Freshservice to simplify operations and accelerate outcomes. Don’t wait, secure your seat today. |
|
|
Are Your Controllers and Sensors Exposed to Threats? |
OT and ICS environments face growing cyber pressure as attackers increasingly target controllers, sensors, and legacy systems not built for today’s threats. With OT and ICS-targeted malware on the rise, organizations must harden these systems now to prevent disruptions to safety, production, and critical operations. |
How to harden your OT environment against threats: |
-
Segment OT systems and ICS networks and enforce strict access controls to limit lateral movement.
- Maintain continuous monitoring, logging, and protocol allowlisting to detect abnormal behavior and block unauthorized commands across industrial environments.
-
Keep an up-to-date asset inventory, manage firmware versions, and implement OT/ICS-specific incident response plans.
|
Strengthening OT and ICS security with structured controls and continuous monitoring is critical as internet-connected industrial environments become prime cyber targets. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
