Jared's Technology Podcast Network · Jared Rimer

Sans News bites episode 30 for the newsletter that is December 9, 2025

·1 hr 39 min·5 clips

Shadowserver saw 77,664 vulnerable IPs, and CISA added React RCE to the KEV catalog.

1. Jared Reimer covers Jared's Technology Podcast Network's SANS News Bites episode 30 built around the December 9, 2025 SANS newsletter. 2. Jared Reimer is the host, transcriber, and reader of the newsletter; SANS Institute is the source of the security advisories and editor commentary. 3. The episode asks what the newsletter says about current security risk, patch urgency, and organizational response. 4. The React section describes CVE-2025-55182, unsafe deserialization in React server components, and active exploitation reported worldwide. 5. AWS, Shadowserver, and Censys appear in the React coverage with figures such as 77,664 vulnerable IPs and more than 2.15 million internet-facing services that may be affected. 6. Jared says federal agencies must update by December 26 because the flaw is in CISA's known exploited vulnerabilities catalog. 7. The Cloudflare item links mitigation work for the React flaw to a global outage that affected about 28% of HTTPS traffic. 8. Jared quotes Cloudflare CTO Dane Netsch and frames the outage as a consequence of body parsing changes made during web application firewall mitigation. 9. The BrickStorm segment says CISA and Canada's Cyber Centre warned about long-term persistent access by state-sponsored cyber actors. 10. The BrickStorm report covers eight ELF malware samples written in Go and targeting VMware vSphere and Windows environments. 11. Jared notes that the report includes YARA rules, a SIGMA rule, and reporting paths through CISA and the Canadian Cyber Centre. 12. The FinCEN section cites more than $2.1 billion in ransomware payments reported between 2022 and 2024 under the Bank Secrecy Act. 13. The same section gives 2023 as the peak year with 1,512 incidents and $1.1 billion in reported ransomware payments. 14. Jared identifies financial services, manufacturing, and healthcare as the most frequently targeted sectors in the FinCEN data. 15. He also reads that bitcoin was the payment method in 97% of reported incidents and that many reports used onion-router communications. 16. The Apaches Tika item says version 3.2.2 or newer is needed because CVE-2025-66516 allows XML external entity injection through crafted XFA files. 17. The OWASP segment covers a practical guide for securely using third-party MCP servers and names tool poisoning, prompt injection, memory poisoning, and tool interference. 18. The episode's tone is annotated news reading with frequent host commentary, brief corrections, and editor quotations from Lee Neely, Kurt Dukes, and William Hugh Murray. 19. People interested in enterprise patching, malware persistence, and ransomware reporting would likely benefit from this episode. 20. Listeners looking for polished production or light entertainment would probably skip it.

As heard by us

A loose but useful security-news readthrough that turns jargon into something listeners can follow.

Jared Reimer's December 9, 2025 SANS News Bytes reads like a blend of security bulletin and informal broadcast diary. It moves from a critical React flaw described as exploited worldwide to a Cloudflare disruption while mitigation was underway, then on to a maximum-severity…

Read the full review in PlayNext →

Why you'd press play

Need a plainspoken walk through security headlines and what they mean?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network