Isometric network nodes depicting zero-day, RCE, and AI smart contract vulnerabilities.

Daily Cybersecurity News - December 12, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

December 12, 2025 9:57 AM 4 min read

Chrome Zero-Day Actively Exploited: Update Immediately

High

Executive Summary

A critical zero-day vulnerability in Google Chrome's V8 JavaScript engine, CVE-2025-13223, is being actively exploited in the wild, potentially enabling remote code execution. Immediate patching of Chrome installations is crucial to mitigate this severe threat.

Vulnerability Details

Affected Product: Google Chrome (V8 JavaScript Engine) prior to versions 142.0.7444.175/.176
Identifier: CVE-2025-13223
CVSS Score: 8.8 (High)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching is required across all Chrome installations.
Attack Vector: Exploitation occurs when a user visits a malicious webpage, leading to potential remote code execution.
Ease of Exploit: A simple visit to a malicious webpage can trigger the vulnerability.

Action Plan

Immediate Action: Update Chrome to version 142.0.7444.175/.176 for Windows, 142.0.7444.176 for macOS, and 142.0.7444.175 for Linux.
Workaround: There are no known workarounds besides updating Chrome.
Detection: Monitor network activity for suspicious ToNumber calls on proxy objects and signs of inline cache tampering.

Relevant professional terms

Blue Team: A group responsible for defending an organization's systems and networks against cyber threats by implementing security controls, monitoring for alerts, and responding to security incidents.
SOC Analyst: A cybersecurity professional who works in a Security Operations Center to monitor, analyze, and respond to security incidents, ensuring the security of an organization's IT infrastructure.

Source: Malwarebytes

React2Shell (CVE-2025-55182) Exploited for Remote Code Execution

Executive Summary

The 'React2Shell' vulnerability, CVE-2025-55182, is a critical remote code execution (RCE) flaw that is being actively exploited due to publicly available exploit code, posing a severe threat. Immediate patching, robust detection mechanisms, and proactive threat hunting are crucial.

Vulnerability Details

Affected Product: React-based applications
Identifier: CVE-2025-55182
CVSS Score: [Score (Severity)]
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching of all vulnerable React-based applications
Attack Vector: Remote code execution
Ease of Exploit: Exploit code is publicly available

Action Plan

Immediate Action: Immediate patching of all vulnerable React-based applications
Workaround: Implement robust detection mechanisms for exploitation attempts
Detection: Conduct proactive threat hunting for associated indicators of compromise

Relevant professional terms

Remote Code Execution (RCE): A vulnerability that allows an attacker to execute arbitrary code on a target system.
Indicators of Compromise (IOCs): Artifacts observed on a network or in an operating system that indicate a computer security compromise.

Source: Sophos News

Ashen Lepus Espionage Campaign Targeting Middle East

Executive Summary

The Hamas-affiliated Ashen Lepus (WIRTE) is actively deploying the AshTag malware suite in espionage campaigns. They are targeting Middle Eastern diplomatic entities to gather geopolitical intelligence.

Key TTPs

Initial Access: Uses decoy PDFs and RAR archives to deliver payloads.
Execution: Employs a multi-stage infection chain, side-loading malicious DLLs (AshenLoader).
Defense Evasion: Enhanced custom payload encryption (AES) and in-memory execution to evade detection.

Campaign Analysis

Ashen Lepus has evolved its operational security, enhancing payload encryption and infrastructure to evade analysis. The group remained active throughout the Israel-Hamas conflict, showing a commitment to continuous intelligence collection. The new AshTag malware suite replaces older C++ tools with a modular.NET backdoor.

Targeting & Infrastructure

Target Profile: Primarily governmental and diplomatic entities in the Middle East (Jordan, Israel, Palestine), with recent expansion to Oman and Morocco.
Infrastructure: Command and control (C2) infrastructure now uses legitimate-looking subdomains often mimicking health or technology sectors.

Actionable Intelligence

Domains: api.healthylifefeed[.]com, api.softmatictech[.]com, auth.onlinefieldtech[.]com
File Hashes (SHA256): f554c43707f5d87625a3834116a2d22f551b1d9a5aff1e446d24893975c431bc (AshenLoader / dwampi.dll)

Relevant Terms

TTPs: Tactics, Techniques, and Procedures, which describe the behavior patterns and methods used by threat actors.
IOCs: Indicators of Compromise, which are artifacts observed on a network or system that indicate a potential intrusion or malicious activity.

Source: Palo Alto Networks

Dll Entrypoint Abuse For Code Execution

Executive Summary

Attackers are abusing DLL EntryPoints, a core Windows PE file component, to achieve code execution, persistence, and defense evasion. This involves manipulating the initial execution flow when a DLL is loaded, allowing malicious actors to execute unintended code.

Key TTPs

Execution: Leveraging DLL EntryPoint for automatic code execution upon loading.
Defense Evasion: Embedding malicious logic within standard-looking DLLs.
Defense Evasion: Bypassing User Account Control (UAC).

Campaign Analysis

Abuse of DLL EntryPoint offers a stealthy method for malware execution, bypassing traditional detection by embedding malicious code within seemingly legitimate DLL files. This technique allows attackers to maintain persistence and escalate privileges, posing a significant threat to system integrity.

Targeting & Infrastructure

Target Profile: Systems running Windows, where attackers can manipulate DLL loading mechanisms.
Infrastructure: Utilizes malicious or modified DLLs that are loaded by legitimate processes.

Relevant Terms

DLL EntryPoint: A relative virtual address within a DLL that indicates where code execution begins upon loading.
DLL Side-Loading: Tricking a program into loading a malicious DLL by exploiting how Windows searches for and loads DLL files.

Source: ISC SANS

AI-Driven Exploits Target Smart Contracts

Executive Summary

New research indicates that AI models are now capable of autonomously discovering and exploiting vulnerabilities in smart contracts, demonstrating a significant shift in offensive cyber capabilities. These AI agents have successfully identified and exploited both novel and known vulnerabilities, highlighting the escalating threat landscape in the smart contract domain.

Key Findings

AI models like Claude Opus 4.5, Claude Sonnet 4.5, and GPT-5 can autonomously discover and exploit zero-day vulnerabilities in smart contracts.
These AI agents uncovered two novel zero-day vulnerabilities in recently deployed contracts, generating $3,694 in exploits at an API cost of $3,476.
Retrospective analysis revealed these AIs could exploit known vulnerabilities for a collective $4.6 million.

The Bottom Line

The emergence of AI-driven exploitation of smart contracts signifies a critical inflection point for cybersecurity. Organizations must recognize the potential for autonomous AI agents to execute sophisticated attacks, necessitating a proactive shift towards integrating AI into defensive strategies. Red teams should prioritize the investigation of AI-driven vulnerability discovery, while blue teams and SOC analysts need to enhance their ability to detect and respond to these evolving threats to safeguard blockchain assets.

Relevant Terms

Zero-Day Vulnerability: A security flaw in software that is unknown to those who should mitigate it.
Smart Contract: A self-executing digital agreement stored on a blockchain that automatically executes when predetermined conditions are met.

Source: schneier.com