⚡ Weekly Recap: IOT Exploits, Wallet Breaches, Rogue Extensions, Ai... (2026)

The year opened without a reset. The same pressure carried over, and in some places it tightened. Systems people assume are boring or stable are showing up in the wrong places. Attacks moved quietly, reused familiar paths, and kept working longer than anyone wants to admit.

This week's stories share one pattern. Nothing flashy. No single moment. Just steady abuse of trust — updates, extensions, logins, messages — the things people click without thinking. That's where damage starts now.

This recap pulls those signals together. Not to overwhelm, but to show where attention slipped and why it matters early in the year.

RondoDox Botnet Exploits React2Shell Flaw — A persistent nine-month-long campaign has targeted Internet of Things (IoT) devices and web applications to enroll them into a botnet known as RondoDox. As of December 2025, the activity has been observed leveraging the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) flaw as an initial access vector. React2Shell is the name assigned to a critical security vulnerability in React Server Components (RSC) and Next.js that could allow unauthenticated attackers to achieve remote code execution on susceptible devices. According to statistics from the Shadowserver Foundation, there are about 84,916 instances that remain susceptible to the vulnerability as of January 4, 2026, out of which 66,200 instances are located in the U.S., followed by Germany (3,600), France (2,500), and India (1,290).

In 2026, the security landscape is littered with unmanaged threats, including AI tools, SaaS apps, devices, and identities. Join 1Password CPO Abe Ankumah and security analyst Francis Odum to hear how security and IT leaders are taking control – without slowing down the pace of innovation.

Hackers act fast. They can use new bugs within hours. One missed update can cause a big breach. Here are this week's most serious security flaws. Check them, fix what matters first, and stay protected.

This week's list includes — CVE-2025-13915 (IBM API Connect), CVE-2025-52691 (SmarterTools SmarterMail), CVE-2025-47411 (Apache StreamPipes), CVE-2025-48769 (Apache NuttX RTOS), CVE-2025-14346 (WHILL Model C2 Electric Wheelchairs and Model F Power Chairs), CVE-2025-52871, CVE-2025-53597 (QNAP), CVE-2025-59887, and CVE-2025-59888 (Eaton UPS Companion).

Disclaimer: These tools are for learning and research only. They haven't been fully tested for security. If used the wrong way, they could cause harm. Check the code

Source: The Hacker News