IT-Sentinel

> TODAY'S SUMMARY (179 articles)

Today's cybersecurity landscape reveals several significant threats and trends. United Airlines has restricted the use of AI agents for flight bookings due to concerns over credential sharing and potential unauthorized purchases. Maersk confirmed a data breach attributed to the WhiteArmor ransomware group, which is demanding a $5 million ransom after exploiting a legacy system. A critical zero-day vulnerability in Microsoft's Windows SignDrop allows local users to gain SYSTEM privileges, raising alarms for affected systems. Additionally, cybersecurity researchers uncovered a credential theft campaign that targeted over 60,000 GitHub repositories, utilizing hijacked accounts to deploy malware. Finally, new vulnerabilities in various software, including Apache and MongoDB, highlight the ongoing need for vigilant patch management and security practices.

// AI-powered summary generated at 20:00

> ISC Stormcast For Tuesday, December 9th, 2025 https://isc.sans.edu/podcastdetail/9730, (Tue, Dec 9th)

[SOURCE] SANS ISC [LANGUAGE: EN] [DATE: 2025-12-09 02:00]

> CVE-2025-40277 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> CVE-2025-40273 NFSD: free copynotify stateid in nfs4_free_ol_stateid()

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> FinCEN data shows $4.5B in ransomware payments, record spike in 2023

[SOURCE] Security Affairs [LANGUAGE: EN] [DATE: 2025-12-09 00:26]

Ransomware payments reported to FinCEN exceeded $4.5B by 2024, with 2023 marking a record year at $1.1B across 1,512 incidents. FinCEN analyzed ransomware trends using Bank Secrecy Act (BSA) reports filed from January 2022 to February 2025. During this period, organizations reported 4,194 ransomware...

> CVE-2025-40280 tipc: Fix use-after-free in tipc_mon_reinit_self().

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> CVE-2025-40281 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> Ransomware gangs turn to Shanya EXE packer to hide EDR killers

[SOURCE] BleepingComputer [LANGUAGE: EN] [DATE: 2025-12-09 00:00]

Several ransomware groups have been spotted using a packer-as-a-service (PaaS) platform named Shanya to assist in EDR (endpoint detection and response) killing operations. [...]

> CVE-2025-40269 ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> CVE-2025-40282 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2025-12-09 01:41]

Information published.

> Multiples vulnérabilités dans les produits SAP (09 décembre 2025)

[SOURCE] CERT-FR [LANGUAGE: FR] [DATE: 2025-12-09 00:00]

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

> CVE-2025-40287 exfat: fix improper check of dentry.stream.valid_size