Do Son Apache Airflow patched two flaws leaking sensitive credentials in the UI. The Moderate bug exposes secrets in DAG tracebacks (kwargs). Also fixed: secrets visible in rendered templates. Update to v3.1.4.
Apple patched two critical zero-days in WebKit (UAF & Memory Corruption) under active exploitation in extremely sophisticated attacks against targeted individuals. Update iOS 26 immediately.
cybernewswire
Torrance, United States / California, 12th December 2025, CyberNewsWire
OpenAI launches GPT-5.2 ("Red Alert") to reclaim the top spot from Gemini 3 Pro. The model achieves perfect math scores and promises unparalleled reliability for enterprise tasks.
Disney invests $1B in OpenAI and licenses 200+ characters (Mickey, Iron Man, Vader) for Sora and ChatGPT Images—a major pivot to defining the rules of AI-generated content.
OpenAI integrates Photoshop, Acrobat, and Adobe Express into ChatGPT via MCP. The move creates an "AI super-app," enabling 800M users to edit images and PDFs directly in chat.
Google rapidly adopts the MCP protocol, launching managed servers for AI agents. This enables seamless, autonomous tool use across Google Maps, BigQuery, and GKE infrastructure.
YouTube TV is shifting to themed subscription bundles in 2026, raising the question: is streaming evolving back into cable under a new name?
Google Labs unveils Disco, an experimental AI browser powered by Gemini 3. It features GenTab, which can generate interactive Progressive Web Apps (PWAs) from web content.
New flaws found in React Server Components risk a Server-Crashing DoS (CVSS 7.5) via infinite loop and Source Code Disclosure (CVE-2025-55183). Update to v19.0.3/19.1.4/19.2.3 immediately.
A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fixed: Weak Password Policy and Unmasked Server Keys. Update to v1.13.0.
New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.
CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.
A military-grade backdoor, ValleyRAT, saw an 85% surge after its builder was leaked. The kernel-mode rootkit bypasses Windows 11 defenses and is now a dangerous commodity for cybercriminals.
A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hijack critical session tokens via dynamic redirection.
A Critical (CVSS 9.8) flaw in Soledad WordPress Theme allows Subscribers to escalate privileges and gain full site takeover by exploiting an exposed AJAX action. Update to v8.6.9.1 immediately.
A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a subtitle file to achieve fileless execution via LotL tools.
GOLD BLADE (RedCurl) targets Canadian firms (80% of attacks) with espionage and QWCrypt ransomware. The group uses fake resumes and a BYOVD EDR killer (Zemana driver) to disable security controls.
Road Town, British Virgin Islands, 11th December 2025, CyberNewsWire
Cary, North Carolina, USA, 11th December 2025, CyberNewsWire
A Notepad++ flaw (now patched in v8.8.9) allowed attackers to hijack the WinGUp update process, serving malware instead of the legitimate executable. Manual update is urged.
After a 16-year legal battle, Intel loses its appeal against the EU's antitrust ruling. The court upheld the "naked restrictions" finding but reduced the final fine to €237 million.