The attack surface keeps shifting… |
This week, familiar tools behave badly, public services feel the strain, and quiet flaws turn loud at scale. From cloud apps to critical infrastructure, small gaps are doing big damage. Read past newsletters here.
👉 Tell us how we can make the newsletter better for you. Click Here |
|
| Here’s what you need to know: |
|
|
PCPcat Campaign Hijacks 59K Servers in 48 Hours |
Security researchers uncovered a campaign that compromised over 59,000 internet-facing Next.js servers in less than 48 hours. Dubbed PCPcat, the campaign exploited two critical RCE flaws to access cloud-hosted applications across major platforms and harvest credentials. |
Patches are available for both vulnerabilities
Patch affected Next.js and React systems immediately, rotate and secure credentials, and monitor for persistence or outbound exfiltration to limit credential-theft risk. |
Cyberattack Knocks La Poste Offline |
A cyber incident disrupted France’s national postal service days before Christmas, taking mail, banking, and digital identity services offline nationwide. La Poste said the attack affected all information systems, with reports attributing the outage to a DDoS attack.
A Russian-affiliated threat actor group has claimed responsibility for the attack. Organizations running mission-critical public services should regularly stress-test DDoS defenses and incident response playbooks. |
INTERPOL Nabs 500+ Cybercrime Suspects |
A month-long international operation led to the arrest of 574 cybercrime suspects across African countries, disrupting BEC, ransomware, and digital extortion campaigns. Coordinated by INTERPOL across 19 countries, Operation Sentinel targeted financially motivated attacks on sectors such as finance and energy. Prioritize MFA and DMARC enforcement, restrict administrative access, and regularly test incident response plans to reduce BEC and ransomware risk. |
|
|
If attackers demand ransomware payment, what’s your approach? |
|
|
Yesterday's Pulse Check Results |
If one of your automation tools was compromised tomorrow, how severe would the impact be? |
|
|
Security Tools You Can Use |
-
Add your perspective on how AI-driven security will define the future of connected and autonomous vehicles.
- Stay ahead of emerging threats with security tools built to protect your organization today.
- Build your own AI-powered bot using ChatGPT, Python, and Django — save 42% for a limited time.
|
|
|
Ransomware Hits Romania’s Water Authority |
A ransomware attack disrupted over 1,000 IT systems at Romania’s national water authority, affecting most regional water basins while leaving operational systems intact. Investigators confirmed the attackers abused BitLocker in a living-off-the-land attack that blended into normal administrative activity and hindered detection.
|
The investigation and recovery are ongoing.
Limit administrative privileges, monitor native tool abuse, maintain IT/OT segmentation, and regularly test backups and incident response plans. |
MongoDB Bug Leaks Server Memory |
A newly disclosed MongoDB flaw allows unauthenticated attackers to extract sensitive data directly from server memory. Tracked as CVE-2025-14847, the flaw affects MongoDB’s handling of zlib-compressed traffic, enabling exposure of uninitialized heap memory and potential leakage of sensitive data. A patch has been released for the vulnerability. Patch all MongoDB instances immediately, restrict network exposure, disable zlib compression where needed, and monitor for unauthenticated or anomalous database activity to reduce memory disclosure risk. |
|
|
How Exposed Are Your Databases? |
Databases remain a prime target for attackers due to misconfigurations, exposed services, and weak access controls. With sensitive business and customer data concentrated in database systems, strong database security practices are essential to reducing risk and limiting blast radius. |
How to lock down your databases: |
-
Enforce strong access controls by using MFA, role-based access, and least-privilege permissions while limiting database exposure to trusted networks and application tiers.
-
Protect data throughout its lifecycle by encrypting data in transit and at rest, securing backups and replicas, and restricting access to sensitive storage locations..
-
Reduce attack surface and improve detection through patch management and continuous monitoring.
|
Strong database security helps organizations protect sensitive data, limit the scope of potential incidents, and maintain operational stability and regulatory assurance. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
