Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
Summary: Cisco Talos's 2025 Year in Review found that React2Shell, disclosed in December, became the most targeted vulnerability Talos tracked within weeks, while a 12-year-old flaw still landed in the top 10 most exploited. The report also recorded a 178 percent year-over-year rise in fraudulent device registration, with attackers targeting administrator-managed registration flows three times as often as user-driven ones, and 40 percent of the top 100 exploited vulnerabilities working because organizations ran end-of-life devices.
What's compelling: Attackers are counting on the long device lifecycles and slow change management that keep unpatched and end-of-life infrastructure in production - 40 percent of the top 100 exploited vulnerabilities succeeded for exactly that reason. And with more than a third of phishing incidents originating from already-compromised accounts, the credentials your users trust are the ones being used against them.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026