Year in Review: Vulnerabilities old and new and something React2
Summary: Cisco Talos's 2025 Year in Review found attackers spent the year exploiting older embedded dependencies such as Log4j and PHPUnit, while React2Shell reached the highest percentage of attacks for the entire year within the last three weeks of 2025. Talos reported that agentic AI lowered attacker time-to-exploit by building and deploying new proofs-of-concept and exploit kits, and that attackers prioritized network appliances, identity-adjacent systems, and widely deployed open-source components, with MFA workflow weaknesses and phishing using valid, compromised credentials as recurring themes.
Bottom line: A vulnerability disclosed in widely deployed software can now climb into the top tier of attack volume in under three weeks, before typical patch cycles catch up, and a small number of flaws in identity components can invalidate MFA checks and bypass segmentation.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026