A very quick exercise in #nuclear power economy, literally on the back of a napkin (well, Wolfram Alpha really):

European Commission approved multi-billion subsidy for Poland first nuclear power plant, with first tranche to Warsaw this month, Donald Tusk announced. Project costs 42 billion euros, government covers 30 percent, guarantees loans. Lubiatowo-Kopalino station in Pomeranian Voivodeship starts construction next year, connects in 2033 with three reactors at 3750 megawatts

42’000’000’000 EUR sounds huge, eh? The point of this exercise is that a power plant produces electricity, which is a tangible resource measured in scalar values. A reasonable lifetime of the plant is 60 years (but many operators now want to extend to 80).

This 3750 MW of power, times 60 years, times 95% capacity factor (loading, maintenance), makes a hefty number, which simply lands in the denominator under that construction cost. You can see the result below: that’s 22 EUR/MWh average production cost over plant’s lifetime.

Add 100% for operational costs. Add another 100% for cost of financing, delays and other random costs and you get 66 EUR/MWh in classic LCOE (levelized cost of electricity) formula, which happens to be the average global LCOE estimate for nuclear power by such reputable organisations as IPCC and IEA. And it is quite realistic, granted that #Finland OL3 has production cost of 42 EUR/MWh after all the delays and cost overruns, so with operational costs added we should get similar total LCOE.

У США розмірковують над новим міжнародним союзом, Core 5 (C5) до якого може долучитися Китай, Індія, Японія та росія, – Politico.

Інформація про C5 нібито містилася в розширеній, неопублікованій версії Стратегії нацбезпеки США. Потенційний формат C5 фактично оминає Європу. 😑

У Польщі затримали відомого російського вченого Олександра Бутягіна, якого Україна розшукувала за незаконні археологічні розкопки в окупованому Криму, – RMF FM.

Його звинувачують у знищенні обʼєктів кримської культурної спадщини. 🏺

Поточна редакція мирного плану Трампа не вимагає від росії виведення військ із Донбасу для створення демілітарізованої зони, а лише від України, – FT.

Пропонується створити "буферну зону" на півночі Донеччини з відведенням українських військ.

Безпілотники СБУ зупинили роботу нафтовидобувної платформи рф у Каспійському морі, – джерела 24 Каналу в Службі безпеки.

Це перше ураження Україною інфраструктури рф, пов’язаної з видобутком нафти в Каспійському морі. 👏🏻

💥Зафіксовано щонайменше 4 влучання по морській платформі. Унаслідок атаки зупинився видобуток нафти й газу з понад 20 свердловин, які вона обслуговує.

НАТО – наступна ціль Росії. Альянс має бути готовим до масштабної війни, - Рютте

Генеральний секретар вважає, що Росія "стала ще більш зухвалою, безрозсудною та безжальною стосовно НАТО та України"

Генеральна Асамблея ООН підтримала українську резолюцію, спрямовану на посилення міжнародної співпраці та мінімізацію наслідків Чорнобильської катастрофи.

Документ отримав підтримку 97 держав. Проти проголосували США, Росія та Білорусь, а також Китай, Північна Корея, Нікарагуа, Конго та

Building Rust Apps For Cheap Hackable Handheld Console

The age of cheap and powerful devices is upon us. How about a 20 EUR handheld game console intended for retro game emulation, that runs Linux under the hood? [Luiz Ferreira] kicks the tires of a R36S, a very popular and often cloned device running a quad-core RK3326 with an Ubuntu-based OS, and shows us how to write and cross-compile a simple app for it using Rust – even if you daily drive Windows.

Since a fair bit of the underlying Linux OS is exposed, you can quickly build even text applications and have them run on the console. For instance, [Luiz]’s app uses ratatui to scan then print button and joystick states to the screen. Perhaps the most important thing about this app is that it’s a detailed tutorial on cross-compiling Rust apps for a Linux target, and it runs wonders using WSL, too.

Installing your app is simple, too: SSH into it, username ark and password ark. Looking for a Linux-powered device with a bright screen, WiFi, a fair few rugged buttons, and an OS open for exploration? This one is quite reassuring in the age of usual portables like smartphones getting more and more closed-off to tinkering. And, if the store-bought hackable Linux consoles still aren’t enough, you can always step it up and build your own, reusing Joycons for your input needs while at it.

hackaday.com/2025/12/11/buildi…

La solidarietà di Stampa Romana ai colleghi de La Stampa e di Gedi

L’Associazione Stampa Romana è al fianco dei colleghi de La Stampa, che oggi non è in edicola, e di tutti i giornalisti di Gedi. La vicenda della cessione delle testate del gruppo è sconcertante, colpisce la dignità delle redazioni, mette a rischio il pluralismo dell’informazione, rinnega l’identità di giornali come Repubblica e la Stampa, che hanno scandito la storia di questo paese, di realtà consolidate come Radio Capital, Deejay, M2O, Huffington Post, dei periodici.

Dismettere alla svelta, senza garanzie sulle prospettive dell’azienda e di chi ci lavora, sembra l’unico obiettivo della proprietà, incapace di concepire e sviluppare progetti credibili, di comprendere e valorizzare un patrimonio costruito in decenni con il lavoro e il coraggio di tanti colleghi. Un percorso sciagurato intrapreso tempo fa con lo smantellamento, a pezzi, di quello che fu il gruppo Espresso. Così, con l’informazione, si impoverisce la democrazia.

dicorinto.it/associazionismo/l…

It didn’t take long: CVE-2025-55182 is now under active exploitation

On December 4, 2025, researchers published details on the critical vulnerability CVE-2025-55182, which received a CVSS score of 10.0. It has been unofficially dubbed React4Shell, as it affects React Server Components (RSC) functionality used in web applications built with the React library. RSC speeds up UI rendering by distributing tasks between the client and the server. The flaw is categorized as CWE-502 (Deserialization of Untrusted Data). It allows an attacker to execute commands, as well as read and write files in directories accessible to the web application, with the server process privileges.

Almost immediately after the exploit was published, our honeypots began registering attempts to leverage CVE-2025-55182. This post analyzes the attack patterns, the malware that threat actors are attempting to deliver to vulnerable devices, and shares recommendations for risk mitigation.

A brief technical analysis of the vulnerability

React applications are built on a component-based model. This means each part of the application or framework should operate independently and offer other components clear, simple methods for interaction. While this approach allows for flexible development and feature addition, it can require users to download large amounts of data, leading to inconsistent performance across devices. This is the challenge React Server Components were designed to address.

The vulnerability was found within the Server Actions component of RSC. To reach the vulnerable function, the attacker just needs to send a POST request to the server containing a serialized data payload for execution. Part of the functionality of the handler that allows for unsafe deserialization is illustrated below:

A comparison of the vulnerable (left) and patched (right) functions

CVE-2025-55182 on Kaspersky honeypots

As the vulnerability is rather simple to exploit, the attackers quickly added it to their arsenal. The initial exploitation attempts were registered by Kaspersky honeypots on December 5. By Monday, December 8, the number of attempts had increased significantly and continues to rise.

The number of CVE-2025-55182 attacks targeting Kaspersky honeypots, by day (download)

Attackers first probe their target to ensure it is not a honeypot: they run whoami, perform multiplication in bash, or compute MD5 or Base64 hashes of random strings to verify their code can execute on the targeted machine.

In most cases, they then attempt to download malicious files using command-line web clients like wget or curl. Additionally, some attackers deliver a PowerShell-based Windows payload that installs XMRig, a popular Monero crypto miner.

CVE-2025-55182 was quickly weaponized by numerous malware campaigns, ranging from classic Mirai/Gafgyt variants to crypto miners and the RondoDox botnet. Upon infecting a system, RondoDox wastes no time, its loader script immediately moving to eliminate competitors:

Beyond checking hardcoded paths, RondoDox also neutralizes AppArmor and SELinux security modules and employs more sophisticated methods to find and terminate processes with ELF files removed for disguise.

Only after completing these steps does the script download and execute the main payload by sequentially trying three different loaders: wget, curl, and wget from BusyBox. It also iterates through 18 different malware builds for various CPU architectures, enabling it to infect both IoT devices and standard x86_64 Linux servers.

In some attacks, instead of deploying malware, the adversary attempted to steal credentials for Git and cloud environments. A successful breach could lead to cloud infrastructure compromise, software supply chain attacks, and other severe consequences.

Risk mitigation measures

We strongly recommend updating the relevant packages by applying patches released by the developers of the corresponding modules and bundles.
Vulnerable versions of React Server Components:

• react-server-dom-webpack (19.0.0, 19.1.0, 19.1.1, 19.2.0)
• react-server-dom-parcel (19.0.0, 19.1.0, 19.1.1, 19.2.0)
• react-server-dom-turbopack (19.0.0, 19.1.0, 19.1.1, 19.2.0)

Bundles and modules confirmed as using React Server Components:

• next
• react-router
• waku
• @parcel/rsc
• @vitejs/plugin-rsc
• rwsdk

To prevent exploitation while patches are being deployed, consider blocking all POST requests containing the following keywords in parameters or the request body:

• #constructor
• # proto
• #prototype
• vm#runInThisContext
• vm#runInNewContext
• child_process#execSync
• child_process#execFileSync
• child_process#spawnSync
• module#_load
• module#createRequire
• fs#readFileSync
• fs#writeFileSync
• s#appendFileSync

Conclusion

Due to the ease of exploitation and the public availability of a working PoC, threat actors have rapidly adopted CVE-2025-55182. It is highly likely that attacks will continue to grow in the near term.

We recommend immediately updating React to the latest patched version, scanning vulnerable hosts for signs of malware, and changing any credentials stored on them.

Indicators of compromise

Malware URLs
hxxp://172.237.55.180/b
hxxp://172.237.55.180/c
hxxp://176.117.107.154/bot
hxxp://193.34.213.150/nuts/bolts
hxxp://193.34.213.150/nuts/x86
hxxp://23.132.164.54/bot
hxxp://31.56.27.76/n2/x86
hxxp://31.56.27.97/scripts/4thepool_miner[.]sh
hxxp://41.231.37.153/rondo[.]aqu[.]sh
hxxp://41.231.37.153/rondo[.]arc700
hxxp://41.231.37.153/rondo[.]armeb
hxxp://41.231.37.153/rondo[.]armebhf
hxxp://41.231.37.153/rondo[.]armv4l
hxxp://41.231.37.153/rondo[.]armv5l
hxxp://41.231.37.153/rondo[.]armv6l
hxxp://41.231.37.153/rondo[.]armv7l
hxxp://41.231.37.153/rondo[.]i486
hxxp://41.231.37.153/rondo[.]i586
hxxp://41.231.37.153/rondo[.]i686
hxxp://41.231.37.153/rondo[.]m68k
hxxp://41.231.37.153/rondo[.]mips
hxxp://41.231.37.153/rondo[.]mipsel
hxxp://41.231.37.153/rondo[.]powerpc
hxxp://41.231.37.153/rondo[.]powerpc-440fp
hxxp://41.231.37.153/rondo[.]sh4
hxxp://41.231.37.153/rondo[.]sparc
hxxp://41.231.37.153/rondo[.]x86_64
hxxp://51.81.104.115/nuts/bolts
hxxp://51.81.104.115/nuts/x86
hxxp://51.91.77.94:13339/termite/51.91.77.94:13337
hxxp://59.7.217.245:7070/app2
hxxp://59.7.217.245:7070/c[.]sh
hxxp://68.142.129.4:8277/download/c[.]sh
hxxp://89.144.31.18/nuts/bolts
hxxp://89.144.31.18/nuts/x86
hxxp://gfxnick.emerald.usbx[.]me/bot
hxxp://meomeoli.mooo[.]com:8820/CLoadPXP/lix.exe?pass=PXPa9682775lckbitXPRopGIXPIL
hxxps://api.hellknight[.]xyz/js
hxxps://gist.githubusercontent[.]com/demonic-agents/39e943f4de855e2aef12f34324cbf150/raw/e767e1cef1c35738689ba4df9c6f7f29a6afba1a/setup_c3pool_miner[.]sh

MD5 hashes
0450fe19cfb91660e9874c0ce7a121e0
3ba4d5e0cf0557f03ee5a97a2de56511
622f904bb82c8118da2966a957526a2b
791f123b3aaff1b92873bd4b7a969387
c6381ebf8f0349b8d47c5e623bbcef6b
e82057e481a2d07b177d9d94463a7441

securelist.com/cve-2025-55182-…

896 accessi a FortiSSL in vendita a 3.000$ tra i quali anche di aziende italiane

Negli angoli più nascosti di internet, il traffico di dati rubati e accessi non autorizzati continua a prosperare. Un recente post apparso su un forum underground chiuso, mostra la vendita di 896 credenziali VPN FortiSSL, complete di indirizzo IP e credenziali in chiaro, a un prezzo complessivo di 3.000 dollari.

Il post nelle underground e la minaccia latente

L’annuncio, pubblicato da un utente elenca gli accessi disponibili per diverse nazioni, tra cui Stati Uniti, Germania, Austria, Singapore, Giappone, Corea del Sud, Italia, Emirati Arabi Uniti, Brasile, Svizzera e Francia. I dati sono offerti nel tradizionale formato ip:port user:password, facilmente utilizzabile da chiunque abbia conoscenze base di rete.

Disclaimer: Questo rapporto include screenshot e/o testo tratti da fonti pubblicamente accessibili. Le informazioni fornite hanno esclusivamente finalità di intelligence sulle minacce e di sensibilizzazione sui rischi di cybersecurity. Red Hot Cyber condanna qualsiasi accesso non autorizzato, diffusione impropria o utilizzo illecito di tali dati. Al momento, non è possibile verificare in modo indipendente l’autenticità delle informazioni riportate, poiché l’organizzazione coinvolta non ha ancora rilasciato un comunicato ufficiale sul proprio sito web. Di conseguenza, questo articolo deve essere considerato esclusivamente a scopo informativo e di intelligence.

La vendita di credenziali VPN rappresenta una minaccia crescente per aziende e privati. Le VPN, strumenti pensati per garantire privacy e sicurezza online, diventano così una porta d’ingresso per attacchi informatici mirati, furti di dati sensibili e attività di spionaggio digitale.

Il fatto che questi accessi siano commercializzati con una “garanzia dell’utente” evidenzia la professionalizzazione del mercato criminale, dove l’affidabilità del venditore è diventata un fattore di marketing tra i cybercriminali.

Secondo gli esperti di cybersecurity, forum di questo tipo stanno diventando sempre più sofisticati, offrendo non solo credenziali, ma veri e propri servizi di accesso a reti aziendali, server FTP e database. La presenza di accessi provenienti da diverse nazioni evidenzia inoltre l’internazionalità del fenomeno, che può avere ripercussioni globali se le credenziali vengono utilizzate per attacchi mirati.

Le autorità e le aziende sono quindi chiamate a rafforzare le difese dei sistemi VPN e ad adottare misure di sicurezza avanzate, come l’autenticazione a più fattori e il monitoraggio continuo degli accessi, per contrastare la proliferazione di credenziali rubate nel dark web.

Cosa devono fare le aziende italiane dopo aver letto questo articolo

L’allarme lanciato da questo post sottolinea quanto sia delicato il confine tra strumenti di protezione e vulnerabilità sfruttabili dai criminali: nel mondo digitale, anche una VPN, se compromessa, può trasformarsi in un rischio significativo per la sicurezza informatica.

Le aziende non possono permettersi di affidarsi alla speranza: la protezione dei sistemi VPN deve diventare una priorità strategica. È fondamentale implementare l’autenticazione a più fattori (MFA) per tutti gli accessi remoti, aggiornare regolarmente le configurazioni dei dispositivi e dei server VPN, e adottare soluzioni di monitoraggio continuo degli accessi e dei log di rete.

Anche la formazione del personale gioca un ruolo cruciale: sensibilizzare dipendenti e collaboratori sulle minacce legate a credenziali compromesse riduce significativamente il rischio di incidenti.

Inoltre, le aziende devono considerare la gestione proattiva delle credenziali, inclusa la rotazione periodica delle password e l’utilizzo di strumenti sicuri per la loro memorizzazione.

Controlli regolari sulle vulnerabilità, audit di sicurezza e simulazioni di attacco consentono di identificare e correggere punti deboli prima che possano essere sfruttati. Solo adottando un approccio integrato e costantemente aggiornato è possibile ridurre il rischio derivante dalla vendita e dall’utilizzo illecito di credenziali VPN nel dark web.

L'articolo 896 accessi a FortiSSL in vendita a 3.000$ tra i quali anche di aziende italiane proviene da Red Hot Cyber.