Dec 13, 2025

— Email 1 —

Subject: Risky Bulletin: EU Struggles to Attract and Retain Cybersecurity Talent

Content:

A recent EU cybersecurity agency survey highlights difficulties faced by public and private organizations in the EU to attract (76%) and retain (71%) cybersecurity professionals. The talent shortage is due to candidates lacking necessary skills, insufficient employer training programs, excessive workloads, burnout, and non-competitive pay. High turnover rates increase risks and hinder further cybersecurity investments.

The survey covered 1,080 organizations in critical sectors such as healthcare, energy, transportation, and banking, with an average cybersecurity budget of €1.5 million (around 9% of total IT spend). Compliance, driven mainly by NIS2 regulations, accounts for 70% of investments. Organizations face challenges patching critical vulnerabilities timely. Reported threats include increased DDoS attacks, ransomware, supply-chain attacks, and phishing.

Additional news items include:

– Resignation of Coupang CEO after a major breach.

– Identification of the Coupang hacker as a former internal cybersecurity employee.

– Petco closing a Vetco Clinics website due to data exposure.

– UK ICO fining LastPass £1.2 million (~$1.6M) for a 2022 breach.

– US indictments of members of pro-Kremlin hacktivist groups.

– New PowerShell security features and Meta restricting abortion-related accounts.

– OpenAI investing in model protections to prevent cyber misuse.

– Android live video feature for emergencies rolling out in US, Mexico, and Germany.

– Upcoming retirement of outdated domain validation methods by CA/B Forum.

Summary is based on multiple technical reports and industry trends highlighting persistent cyber risks and regulatory focus across the EU and globally.

— Email 2 —

Subject: Hacker Newsletter #774s – Weekly Tech & Security Highlights

Content:

A curated collection of top Hacker News posts, projects, and discussions from 2025-12-12, including:

• Featured sponsors: Cursor’s WorkOSRadar to prevent trial abuse through device fingerprinting.
• Popular reads include Netflix’s acquisition of Warner Bros, Australia’s teen social media ban enforcement, and a vintage 3D portfolio.
• Development insights: Latest in Django 6.0, automated note-taking tools, and licensed open-source alternatives.
• Data & AI: Introduction of GPT-5.2, innovative data catalogs without Kafka or Elasticsearch.
• Design and UX: Critiques of icons in menus and recreations of historic web styles.
• Books and learning: Recommended math and physics texts and modern C# techniques.
• Productivity and career advice addressing cost trends in software development and hiring approaches.
• Scientific highlights on Earth’s ambient radiation and human hair growth mechanics.
• Startup news like IBM’s acquisition of Confluent and Disney partnering with OpenAI.
• Entertainment and fun: Endless word search games and typewriter plotters.

This newsletter anchors the community with technology trends, project showcases, and insightful commentary for developers, security professionals, and researchers.

— Email 3 —

Subject: UK ICO Fines LastPass £1.2 Million over 2022 Data Breach

Content:

The UK Information Commissioner’s Office imposed a £1.2 million (~$1.6M) fine on LastPass due to a 2022 breach exposing data of 1.6 million UK customers. Hackers accessed backup data from an AWS S3 bucket, compromising email addresses, IPs, names, and phone numbers but not customer passwords (stored encrypted on devices).

Additional insights:

– Cybercriminals impersonate law enforcement to extract sensitive user info from major tech companies including Apple and Amazon.

– SMS activation services offering throwaway phone numbers at low cost undermine the effectiveness of SMS 2FA, as shown by University of Cambridge research.

– Chinese-made inverter devices are widely used in US utilities, raising cybersecurity concerns due to ties to Chinese state actors.

– A second ransomware hit targeted Ireland’s Health Service Executive in February 2025 with no patient data breach confirmed.

– Northern Ireland Justice Minister faces criticism for confusion about compensation funds after PSNI data breach involving officer details.

– South Korea plans punitive fines up to 3% of annual sales for organizations with repeated data breaches enhancing accountability.

– UK sanctions two Chinese firms for cyberattacks against British IT networks.

– Hackers leaked source code and documents from a Russian military registration software developer.

– CyberVolk, a pro-Kremlin ransomware group, returned but reveals application flaws allowing free decryption.

– Notepad++ patched a failed security update mechanism exploited to deliver malware.

– Push Security reported a novel OAuth phishing attack called ConsentFix targeting Microsoft accounts via Azure CLI flows.

– Petco took down Vetco Clinics website after exposure of sensitive customer and pet data.

– The NSA deputy director appointment was withdrawn amid political pushback.

This detailed report compiles diverse developments impacting cybersecurity governance, threat landscape, and critical infrastructure.

— Email 4 —

Subject: Notepad++ Updater Flaw Patched After Traffic Hijackings; Microsoft Expands Bug Bounty

Content:

SecurityWeek reports the following key cybersecurity updates:

• Notepad++ released version 8.8.9 patching a critical flaw in its WinGUp update tool that allowed attackers to hijack update traffic and deliver malicious executables, observed in targeted reconnaissance against East Asia interests.
• Microsoft expanded its bug bounty program to cover vulnerabilities in third-party code impacting Microsoft services, increasing rewards to incentivize broader security coverage.
• MITRE published its 2025 list of the top 25 most dangerous software vulnerabilities.
• CISA ordered patches for a critical GeoServer XML External Entity vulnerability (CVE-2025-58360) actively exploited in the wild.
• Reports on recent cloud software exploits, Wide Range of React2Shell malware incidents, formerly Accenture employee charged for cybersecurity fraud, and unpatched Gogs zero-day exploitation.
• Important patches from IBM, Fortinet, Ivanti, and SAP with December 2025 updates.

Offers thought leadership articles highlighting the convergence of cybersecurity with business, the rising role of AI in phishing, and bridging communication gaps in security teams.

— Email 5 —

Subject: White House Signing Executive Order to Preempt State-Level AI Regulations

Content:

The CyberWire daily briefing covers:

• President Trump signed an executive order establishing a national policy framework to supersede individual US state AI regulations. The administration argues that a patchwork of 50 state laws hinders innovation, can impose ideological bias in AI models, and overreaches into interstate commerce. States like California, Utah, Colorado, and Texas with existing AI laws may face federal funding restrictions if non-compliant.

• Huntress researchers warn of an unpatched remote code execution vulnerability exploiting hardcoded cryptographic keys in Gladinet’s CentreStack and Triofox platforms, affecting nine organizations. Users should update immediately.

• UK ICO fined LastPass £1.2 million (~$1.6 million) in relation to a 2022 breach where attackers accessed backup data of 1.6 million users; passwords remained secure as they are stored locally on client devices.

Sponsored content and upcoming virtual sessions focus on managing AI-induced risks and human factors in cybersecurity.

Selected reading includes:

– MITRE 2025’s Top 25 Vulnerabilities

– US NSA Deputy Director nomination updates

This briefing consolidates critical policy developments, threat advisories, and industry news relevant to cybersecurity professionals.

Stay Well!