Loading story…
Reporting highlighted the widening gap between vulnerability volume and real-world exploitation: a VulnCheck analysis of 2025 data found more than 40,000 new vulnerabilities disclosed, but only ~1% (422) were exploited in the wild, reinforcing that CVSS alone is increasingly insufficient for prioritization. The same reporting emphasized that network edge devices remain a disproportionately common intrusion point (cited as 191 of 672 products impacted by new known-exploited vulnerabilities), reflecting attacker preference for internet-facing, privileged-access technologies and long-lived codebases.
Separate coverage underscored broader risk trends rather than a single incident: the PCI Security Standards Council warned that threats to payment systems are accelerating and require faster global coordination and evolving standards, while a CSIS incident roundup documented multiple 2025 events including Medusa’s claimed breach of SimonMed Imaging (~1.2M patients) and other ransomware, hacktivist, and APT activity. Additional items in the set were largely non-specific or promotional (a newsletter/webinar plug, venture-capital market coverage, and a mixed CSO page that includes a “fake Zoom meeting” malware story but without enough detail here to tie it to the other reporting), and do not describe the same discrete security event as the vulnerability-exploitation and payments-risk reporting.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
VulnCheck released a report summarizing 2025 vulnerability exploitation trends, highlighting network edge devices as a preferred intrusion point and noting concentration among vendors such as Microsoft, Ivanti, Fortinet, VMware, SonicWall, and Oracle. The report argued that the core problem is technology resilience and the widening gap between attacker capability and defensive capacity.
The PCI Security Standards Council published its first-ever annual report covering 2025, saying change in payment systems is accelerating and threats are becoming more sophisticated. The report emphasized transparency, global coordination, and continued updates to standards, training, and compliance efforts.
BridgePay Network Solutions disclosed a ransomware attack that led to extended service disruptions, illustrating ongoing cyber risk in the payments sector. The exact incident date is not provided in the references.
A cluster of four Microsoft SharePoint zero-days — CVE-2025-53770, CVE-2025-53771, CVE-2025-49706, and CVE-2025-49704 — was exploited at scale in 2025. VulnCheck said the campaign initially compromised more than 400 organizations, including multiple U.S. federal departments.
VulnCheck identified React2Shell in React Server Components as the most targeted vulnerability of 2025, with hundreds of public exploits appearing quickly and dozens of organizations affected. The report cited it as an example of rapid weaponization and broad attacker interest.
According to VulnCheck, 422 vulnerabilities, about 1% of those published in 2025, were observed being exploited in real-world attacks. The finding underscored the need for defenders to prioritize based on exploitation activity rather than CVSS scores alone.
VulnCheck reported that over 40,000 vulnerabilities were newly published across 2025, reflecting continued growth in the volume of disclosed software flaws. The report said only a small fraction would later be exploited in the wild.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple outlets published **weekly cybersecurity roundups** summarizing a mix of vulnerability disclosures, ransomware/breach reporting, and policy developments rather than a single discrete incident. TechTarget highlighted a surge in reported vulnerabilities (citing **48,000+ new CVEs in 2025**) and called out several high-impact issues, including a **critical ServiceNow weakness** tied to weak authentication in the legacy *Virtual Agent* chatbot that became more dangerous when paired with agentic AI (*Now Assist*), potentially enabling impersonation and **admin-level access** into connected enterprise systems. Other roundup coverage aggregated unrelated security events across sectors. Sherpa Intelligence’s “Five for Friday” compiled items including ransomware claims (e.g., **Everest** targeting Nissan; **Nightspire** claiming an attack on a Hyatt Place property) and breach reporting (e.g., a **Korean Air** employee-data breach attributed to **Clop**). The Cyber Express weekly roundup similarly mixed disparate topics (platform policy changes around AI abuse, senior government appointments, and national-level connectivity disruptions), reinforcing that the common thread is **curation of multiple stories** rather than new primary reporting on one specific cyber event.
Jun 29, 2026
CrowdStrike’s 2025 global threat reporting says financially motivated intrusions are accelerating, with **average breakout time** (lateral movement after initial access) dropping to **29 minutes** and the fastest observed breakout time at **27 seconds**; the report also describes attackers increasingly using **social engineering**, **living-off-the-land** techniques, and abuse of **trusted systems** to move across *cloud, identity, enterprise,* and unmanaged device boundaries, alongside a reported **37% year-over-year increase** in cloud-focused attacks and a growing set of tracked adversaries (281 named groups plus additional activity clusters). Check Point Research’s 2025 retrospective similarly emphasizes that many 2025 operations relied on **familiar techniques combined in new ways**, highlighting themes such as early **ToolShell** exploitation assessed as Chinese-nexus activity against North American government targets and **identity-centric** intrusions (including **AiTM** credential theft) against US think-tank researchers. Several other items in the set are not about these annual threat-report findings and instead cover separate topics: Romania’s cyber chief warning that ransomware incidents against critical infrastructure may align with **Russian hybrid objectives**; sector-level reporting that **manufacturing** remains heavily targeted by ransomware due to IT/OT interconnectivity and downtime pressure; and US law-enforcement/FBI reporting on a surge in **ATM jackpotting** losses and related indictments. Additional entries are primarily **generic commentary, newsletters, or professional/educational content** (e.g., quantum-preparedness opinion, Enigma/RSAC history piece, a weekly video briefing, a malware-newsletter link roundup, a recon how-to article, and a governance/career feature page) and do not substantively corroborate the specific annual threat-report story.
Jun 29, 2026
Two weekly “roundup” articles summarized a broad set of security developments rather than a single incident. Reported items included **data breaches** (e.g., PayPal, SpyX, California Cryobank), **active exploitation of multiple vulnerabilities** (including a **Google Chrome 0-day** and critical issues in products such as *BeyondTrust*, *Ivanti EPMM*, *Splunk Enterprise*, and *Windows Admin Center*), and **ransomware activity** (e.g., **Hellcat** reportedly breaching Ascom’s ticketing infrastructure and exfiltrating ~44GB of data). The digest also highlighted availability risk via a reported **Cloudflare** global outage attributed to a cascading password-rotation failure. The week-in-review content also mixed security news with interviews and tool/project updates, including discussion of the evolving CISO role amid **agentic AI**, the release of *REMnux v8* (malware analysis distro) with AI integration, and commentary on “harvest now, decrypt later” **quantum** risk. It additionally referenced separate security headlines such as a **firmware-level Android backdoor** on tablets and a **Dell zero-day** reportedly exploited since 2024, but did not provide a unified, single-event narrative across the items.
Jun 29, 2026