Threats affecting United Kingdom

A data breach involving Red Hat's GitLab instance has exposed personal data of approximately 21,000 Nissan customers. The breach was reported via Reddit's InfoSecNews community and linked to a news article on securityaffairs.com. Although technical details about the breach vector or exploited vulnerabilities are not provided, the incident is classified as high severity due to the exposure of sensitive customer information. No known exploits are currently active in the wild, and the discussion level around this breach remains minimal. The breach highlights risks associated with third-party code repositories and development platforms. European organizations, especially those in automotive sectors or with customer data stored in similar environments, could face increased risk. Mitigation requires enhanced access controls, monitoring of repository activity, and incident response readiness. Countries with significant automotive industries and strong Nissan market presence, such as Germany, France, and the UK, are likely to be most impacted. Given the data exposure and potential for identity theft or fraud, the suggested severity is high.

Breach#infosecnews#redditGermany+5

CVE-2025-12839 is a high-severity heap-based buffer overflow vulnerability in the Academy Software Foundation's OpenEXR library version 3.4.0. It arises from improper validation of user-supplied data length during EXR file parsing, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious EXR file or visiting a crafted webpage. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently in the wild. European organizations using OpenEXR in media, visual effects, or related industries should prioritize patching and implement strict file validation and sandboxing. Countries with strong media production sectors like the UK, Germany, and France are most likely affected.

EPSS 0.2%VulnerabilityCWE-122Germany+2

CVE-2025-13715 is a high-severity remote code execution vulnerability in Tencent FaceDetection-DSFD's resnet endpoint caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses significant risks to affected systems. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction. European organizations using Tencent FaceDetection-DSFD should prioritize patching and implement strict input validation and network segmentation to mitigate risks. Countries with significant technology sectors and Tencent product usage, such as Germany, France, and the UK, are likely to be most affected. Immediate attention is warranted to prevent potential exploitation in sensitive environments.

EPSS 0.4%VulnerabilityCWE-502Germany+2

CVE-2025-13709 is a high-severity remote code execution vulnerability in Tencent TFace's restore_checkpoint function caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected systems. The CVSS score is 7.8, reflecting high impact on confidentiality, integrity, and availability. European organizations using Tencent TFace, especially in sectors relying on AI and facial recognition technologies, should prioritize patching and implement strict input validation and network segmentation. Countries with strong technology sectors and high adoption of Tencent products, such as Germany, France, and the UK, are most likely to be affected. Immediate mitigation and monitoring are recommended to prevent potential exploitation.

EPSS 0.5%VulnerabilityCWE-502Germany+2

CVE-2025-14929 is a high-severity vulnerability in Hugging Face Transformers affecting the X-CLIP checkpoint conversion process. It arises from improper validation of user-supplied data during deserialization, enabling remote code execution if a user opens a malicious file or visits a crafted webpage. Exploitation requires user interaction but no prior authentication. The vulnerability impacts confidentiality, integrity, and availability by allowing arbitrary code execution within the affected process context. No known exploits are currently in the wild. European organizations using vulnerable versions of Hugging Face Transformers, especially in AI/ML workflows, face significant risk. Mitigation involves avoiding untrusted checkpoint files, applying patches when available, and implementing strict input validation and sandboxing. Countries with strong AI sectors and extensive use of Hugging Face tools, such as Germany, France, the UK, and the Netherlands, are most likely affected.

EPSS 0.4%VulnerabilityCWE-502#brew-mlx-lm-cve-2025-14929Germany+3

CVE-2025-14920 is a high-severity remote code execution vulnerability in the Hugging Face Transformers library, specifically affecting the Perceiver model deserialization process. The flaw arises from improper validation of user-supplied model files, allowing deserialization of untrusted data. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage. Successful exploitation enables attackers to execute arbitrary code with the privileges of the current user. Although no known exploits are reported in the wild, the vulnerability poses significant risks to confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8, reflecting its high impact and relatively low complexity to exploit. European organizations using Hugging Face Transformers in AI/ML workflows, especially those processing untrusted or external model files, are at risk. Mitigation involves strict validation of model inputs, restricting model file sources, and applying patches once available. Countries with strong AI development sectors and extensive use of open-source ML frameworks, such as Germany, France, and the UK, are most likely affected.

EPSS 0.4%VulnerabilityCWE-502Germany+2

CVE-2025-14926 is a high-severity code injection vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It allows remote attackers to execute arbitrary Python code by supplying a malicious checkpoint configuration. Exploitation requires user interaction, as the target must convert a crafted checkpoint file. The vulnerability arises from improper validation of user-supplied strings before execution, enabling code execution with the privileges of the current user. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. This vulnerability poses a significant risk to organizations using Hugging Face Transformers for machine learning model management or deployment. European organizations relying on this library, especially in AI research and development sectors, should prioritize patching or mitigating this issue. Countries with strong AI and tech industries, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

EPSS 0.3%VulnerabilityCWE-94Germany+3

CVE-2025-14921 is a high-severity remote code execution vulnerability in the Hugging Face Transformers library, specifically affecting the Transformer-XL model deserialization process. The flaw arises from improper validation of user-supplied model files, enabling deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file, allowing attackers to execute arbitrary code with the privileges of the current user. The vulnerability impacts confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using vulnerable versions of Hugging Face Transformers are at risk, especially those integrating Transformer-XL models in their AI workflows. Mitigation involves strict validation of model files, restricting model sources, and applying updates once patches become available. Countries with significant AI development and adoption, such as Germany, France, and the UK, are more likely to be affected due to higher usage of these tools.

EPSS 0.3%VulnerabilityCWE-502Germany+2

A significant cyberattack has disrupted France's postal and banking services, causing major operational outages. The attack, reported on December 23, 2025, targeted critical national infrastructure, impacting essential financial and communication services. Although specific technical details and exploited vulnerabilities are not disclosed, the incident underscores the high risk posed by cyber threats to vital public and private sector systems. European organizations, especially those in France, face increased risks of service disruption, financial loss, and reputational damage. The attack highlights the need for enhanced cybersecurity measures tailored to critical infrastructure. Mitigation should focus on improving incident response, network segmentation, and threat intelligence sharing. Countries with strong financial sectors and reliance on postal services are particularly vulnerable. Given the attack's scale and impact, the severity is assessed as high. Defenders must prioritize resilience and rapid recovery capabilities to mitigate similar threats in the future.

News#infosecnews#redditFrance+6

Two malicious Chrome extensions have been discovered stealing user credentials from over 170 websites without user consent. These extensions covertly capture login information, posing significant risks to user privacy and organizational security. The threat exploits the trust users place in browser extensions, enabling attackers to harvest sensitive data across a wide range of online services. European organizations using Chrome browsers are at risk, especially if employees install these extensions. The attack does not require user interaction beyond installation, and no authentication bypass is needed once the extension is active. Mitigation involves immediate removal of the malicious extensions, restricting extension installations via enterprise policies, and educating users about extension risks. Countries with high Chrome usage and significant digital service adoption, such as Germany, France, and the UK, are particularly vulnerable. Given the broad scope and ease of exploitation, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and monitor for suspicious credential access patterns.

News#infosecnews#redditGermany+9

The MacSync Stealer is a newly identified malware targeting macOS systems by masquerading as a trusted Mac application. Its primary objective is to stealthily harvest saved passwords from the victim's device. Although it currently lacks known exploits in the wild and detailed technical indicators, its disguise as a legitimate app increases the risk of user installation and subsequent credential theft. This threat poses a medium severity risk due to its potential impact on confidentiality and the ease of social engineering involved. European organizations using macOS devices are at risk, especially those with employees who may install unverified applications. Mitigation requires enhanced endpoint protection, user education on application trust, and strict application whitelisting policies. Countries with higher macOS adoption and significant technology sectors, such as Germany, the UK, France, and the Nordics, are more likely to be affected. Given the malware’s focus on credential theft without requiring complex exploitation or user interaction beyond installation, the threat severity is assessed as medium. Defenders should prioritize detection of suspicious app behavior and restrict installation of unverified software to reduce exposure.

Malware#infosecnews#redditGermany+8

During the holiday season, threat actors exploit overloaded inboxes and financial stress through two main patterns: Docusign-themed phishing for corporate credential harvesting and loan offer spam for personal data theft. The Docusign campaign uses spoofed emails with authentic-looking branding, redirecting through disposable hosting platforms to a credential harvesting page. The loan scams range from obvious 'Xmas loan' offers to sophisticated marketing-style emails, ultimately leading victims to a detailed identity theft questionnaire on christmasscheercash.com. Both scams utilize seasonal themes and mimic normal end-of-year workflows to increase effectiveness. Defensive measures include verifying sender domains, validating link destinations, and treating unsolicited loan offers as high risk.

Campaign#identity theft#phishingUnited Kingdom+5

The personal information of 21,000 customers was stolen after hackers compromised Red Hat’s GitLab instances. The post Nissan Confirms Impact From Red Hat Data Breach appeared first on SecurityWeek .

BreachGermanyFrance+6

The cybercriminals attempted to steal $28 million from compromised bank accounts through phishing. The post Feds Seize Password Database Used in Massive Bank Account Takeover Scheme appeared first on SecurityWeek .

PhishingGermanyFrance+5

A pirate group known as Anna’s Archive has reportedly scraped and copied 256 million songs from Spotify, creating a massive unauthorized dataset of copyrighted music. This data scrape does not appear to exploit a technical vulnerability in Spotify’s systems but rather involves large-scale data extraction, likely through automated means. While no direct compromise of Spotify’s infrastructure or user data is indicated, the incident raises concerns about intellectual property theft and potential redistribution of copyrighted content. European organizations in the music, media, and digital rights management sectors could face increased challenges related to piracy and copyright enforcement. The threat does not involve malware or direct system compromise but represents a significant data theft campaign impacting content owners. Mitigation focuses on enhanced monitoring for unauthorized data scraping, legal enforcement actions, and collaboration with platform providers to detect and block abusive behaviors. Countries with large music markets and strong digital content industries, such as the UK, Germany, and France, are most likely to be affected. Given the nature of the threat, the suggested severity is medium, reflecting the impact on intellectual property rather than direct cybersecurity risks to infrastructure or user data.

Campaign#infosecnews#redditGermany+6

A critical vulnerability in n8n, an open-source workflow automation tool, has been disclosed with a CVSS score of 9.9, enabling arbitrary code execution on thousands of instances. This flaw allows attackers to execute malicious code remotely, potentially compromising confidentiality, integrity, and availability of affected systems. Although no known exploits are currently in the wild, the severity and ease of exploitation make this a high-risk threat. European organizations using n8n for automation and integration tasks could face significant operational disruptions and data breaches. Immediate patching and mitigation are essential to prevent exploitation. The countries most likely affected are those with high adoption of n8n and significant digital transformation initiatives, including Germany, the UK, France, and the Netherlands. Mitigation requires applying vendor patches when available, restricting network access to n8n instances, and implementing strict input validation and monitoring. Given the critical impact and ease of exploitation without authentication, this threat is assessed as critical severity. Defenders must prioritize detection and response strategies to mitigate potential attacks leveraging this vulnerability.

Vulnerability#infosecnews#redditGermany+3

The U. S. Department of Justice (DoJ) has seized a fraudulent domain involved in a sophisticated bank account takeover scheme that resulted in losses of approximately $14.6 million. This scheme involved cybercriminals using the domain to facilitate unauthorized access to victims' bank accounts, enabling fraudulent transactions. Although the domain seizure disrupts this particular operation, the underlying tactics and techniques used in such schemes remain a significant threat. European organizations, especially financial institutions and their customers, could be targeted by similar account takeover attacks leveraging phishing, credential stuffing, or social engineering. The threat highlights the ongoing risk posed by fraud domains that enable large-scale financial theft. Mitigation requires enhanced monitoring for suspicious domain activity, multi-factor authentication enforcement, and user awareness training. Countries with large financial sectors and high digital banking adoption, such as the UK, Germany, and France, are particularly at risk.

News#infosecnews#redditGermany+6

Baker University experienced a data breach in 2024 affecting approximately 53,000 individuals. The breach likely involved unauthorized access to sensitive personal information, although specific technical details about the attack vector or compromised data types are not provided. This incident highlights the ongoing risks faced by educational institutions as targets for cyberattacks. The breach's impact includes potential exposure of personal data, leading to privacy violations and increased risk of identity theft for affected individuals. European organizations, especially universities and educational institutions with similar data management practices, should be aware of such threats. Mitigation requires enhanced security controls around data access, continuous monitoring, and incident response readiness. Countries with significant higher education sectors and data privacy regulations, such as Germany, France, and the UK, may be particularly sensitive to similar breaches. Given the breach scale, lack of detailed technical exploitation information, and the nature of data involved, the suggested severity is high due to the potential confidentiality impact and the large number of affected individuals.

Breach#infosecnews#redditGermany+6

The package provides legitimate functionality to evade detection, while stealing users’ data and deploying a backdoor. The post NPM Package With 56,000 Downloads Steals WhatsApp Credentials, Data appeared first on SecurityWeek .

MalwareGermanyFrance+4

A novel technique has been demonstrated that abuses the List-Unsubscribe email header to perform Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks. This involves leveraging the List-Unsubscribe header, which is commonly used by email clients to allow users to easily unsubscribe from mailing lists, as an attack vector to induce SSRF or XSS vulnerabilities. Although no known exploits are currently in the wild, the technique poses a medium severity risk due to its potential to bypass traditional security controls and impact confidentiality and integrity. European organizations that rely heavily on email marketing or automated unsubscribe mechanisms could be targeted, especially those with complex email processing infrastructure. Mitigation requires careful validation and sanitization of List-Unsubscribe header URLs, restricting internal network access from email processing components, and monitoring for unusual outbound requests triggered by email clients or servers. Countries with large digital marketing sectors and advanced email infrastructure, such as Germany, the UK, France, and the Netherlands, may be more exposed. Given the ease of exploitation without authentication and the potential to impact internal systems, the suggested severity is medium. Defenders should prioritize reviewing email handling systems and applying strict input validation to mitigate this emerging threat.

News#netsec#redditGermany+5