InfoSec.Watch — Issue #119

Aflac confirms 22.65M impacted in June 2025 security incident

Aflac said its review found personal information associated with ~22.65 million individuals was involved and it has begun notifying impacted people.

Source: Aflac Newsroom • SecurityWeek

💡 Key Takeaway: Treat “file review” timelines as part of incident response: pre-stage notification runbooks, evidence retention, and identity-monitoring procurement so you’re not scrambling months later.

French postal + banking services disrupted again by cyberattack

La Poste and La Banque Postale reported renewed service disruptions attributed to a cyberattack, following earlier disruption around the holidays.

Source: RFI

💡 Key Takeaway: Validate DDoS readiness beyond edge capacity: ensure alternate customer comms channels, rate-limit sensitive endpoints (tracking, login), and rehearse failover + status-page workflows.

MongoDB issues security update for CVE-2025-14847 “MongoBleed”

MongoDB published a security update for an unauthenticated memory-leak issue (CVE-2025-14847) and released patched builds; researchers report exploitation activity.

Source: MongoDB • Tenable • NVD

💡 Key Takeaway: If you expose MongoDB to the internet, prioritize patching and add compensating controls immediately (IP allowlists, auth, TLS) — memory disclosure can leak keys and credentials.

CVE-2025-14733 — WatchGuard Fireware OS IKEv2 VPN RCE (actively exploited)

A critical out-of-bounds write in the IKE daemon can enable unauthenticated remote code execution in specific IKEv2 VPN configurations.

Source: WatchGuard PSIRT (WGSA-2025-00027)

💡 Key Takeaway: Patch first, then hunt: review VPN/IKE logs, watch for abnormal daemon restarts or config changes, and restrict management-plane access to trusted networks only.

CVE-2025-52691 — SmarterMail arbitrary file upload → potential RCE (CVSS 10.0)

Singapore’s CSA warned of a maximum-severity SmarterMail flaw that could allow unauthenticated file upload to arbitrary locations, enabling code execution.

Source: Singapore CSA Alert • NVD

💡 Key Takeaway: Patch/upgrade immediately and audit web-exposed endpoints; add file-integrity monitoring for web roots and block suspicious upload paths at the reverse proxy/WAF.

Security teams are getting lured by fake GitHub exploit PoCs

Kaspersky reports a campaign distributing WebRAT via GitHub repos masquerading as exploit code for high-profile vulnerabilities, targeting people searching for PoCs.

Source: Kaspersky Securelist

💡 Key Takeaway: Treat PoCs like malware: fetch in a sandbox, verify repo history/signatures, and prefer vendor/Project Zero references over random GitHub “exploit” repos.

Gato — assess GitHub Actions / self-hosted runner attack paths

Praetorian’s Gato maps CI/CD attack paths (especially around GitHub Actions and self-hosted runners) so you can identify where workflow edits could enable code execution on runners.

Source: GitHub: praetorian-inc/gato (Wiki)

💡 Key Takeaway: If you run self-hosted runners, identify repos where PR/workflow changes can reach privileged runners — then tighten permissions, runner scoping, and approval gates.

Knownsec leak reportedly exposes offensive tradecraft and targeting artifacts

Resecurity says it analyzed a leaked dataset tied to Knownsec, describing tools and artifacts consistent with offensive cyber operations and intelligence collection.

Source: Resecurity

💡 Key Takeaway: Use leaks as detection fuel: extract IoCs (domains, tool names, infra patterns) and map them to your telemetry to validate coverage.

CVE-2025-68613 — n8n workflow automation RCE reported

Resecurity described a critical RCE issue in n8n’s expression evaluation, highlighting broad exposure and risk via automations and integrations.

Source: Resecurity

💡 Key Takeaway: Inventory automation platforms and lock them down: least-privilege tokens, network segmentation, and strict update SLAs.

Belgium’s CCB issues warning on SmarterMail CVE-2025-52691

Belgium’s national cyber authority published guidance on the SmarterMail unauthenticated arbitrary file upload vulnerability and recommended immediate remediation.

Source: CCB Belgium

💡 Key Takeaway: If you can’t patch instantly, mitigate by restricting admin access, enforcing IP allowlists, and monitoring for unexpected file writes on mail servers.

Add a “PoC quarantine” workflow for researchers and responders

Standardize exploit-handling: isolate downloads, detonate in a disposable sandbox, validate provenance, and only then move vetted PoCs into test labs or internal tooling.

💡 Key Takeaway: This reduces the chance your team becomes the initial access vector while investigating emerging vulnerabilities.

The fastest path to compromise is still the same: exposed edge services, weak identity controls, and defenders rushing unvetted code into their workflows. Tighten the perimeter, accelerate patching, and treat “research artifacts” as hostile until proven otherwise.

💡 Key Takeaway: Make “time-to-mitigate” and “time-to-verify” measurable — and automate both wherever you can.