IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response Talos IR engagements - a notable increase from less than 10 percent last quarter. This spike is largely attributable to ...

PT-2025-43493

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges...

PT-2025-43497

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

PT-2025-43541

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11 Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory /tmp on the host machine. If a token is compromised, an...

MAL-2025-48554 Malicious code in js-repack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a80a1c4ce3e508e53f6fbcff1d53486d344d5e88efb691abaad37cc22759f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-medias (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b5575c56531df502495b31c4b90170d35d991772b25b712d15dc9fdac0e33df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webpack-compilejsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c67f3bbe4e8eda380dcbe093fc343b501dc38045f134cb5803093a91b9f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-62772

On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

Malicious code in funny-pad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3cde1ae2412402edab8edbe484702139f4baa345143fb9973baaf3a947f242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48543 Malicious code in artyfact-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e7943603e230dc9bc1cd9f5f44133fe1b4fee90cb69929ae4b0308b61400753 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hash-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 797126e9eb0f67390ff12806c31b6cca28e65c31d1eb9b186dbb591b0db9c941 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization of Groovy code provided by delegated administrators. A privileged attacker can execute arbitrary code remotely by providing malicious Groovy implementations that are loaded and executed by the...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0 <=3.0.13), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0 <=3.0.13) +38 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-persistence-api (>=3.0.0-M0 <=3.0.13)

org.apache.syncope.core:syncope-core-persistence-api MAVEN version =3.0.0-M0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.13 and more Source cves: CVE-2025-57738 Source ad...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0 <=4.0.1), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0 <=4.0.1) +36 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-persistence-api (>=4.0.0 <=4.0.1)

org.apache.syncope.core:syncope-core-persistence-api MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 and more Source cves: CVE-2025-57738 Source advisory: SNYK:JAV...

Malicious code in tailwind-setting (npm)

The package tailwind-setting was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 850a3c165ca8ecb1060d82506ab99a36786c8a41575310ee91507065a46d313d Any computer that has this package installed or running should be considered fully...

Malicious code in dist-decoder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d6276f9115715018347a416b17686c81064ab130b386dacfdbe52f80bf1a2d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ggtech (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8cf2fc1fc656139527e8de1f48461e0236042e241e681f04dc59b29b8c961e Any computer that has this package installed or running should be considered...

Exploit for CVE-2025-56799

CVE-2025-56799 OS Command Injection Vulnerability via Cach...

Malicious code in webpack-loadcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d590321a232bcb801aa8ef974d8eca8774570f32d2f87e026c6694aff0a6bd45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...