🚨 Identity and Edge exploits defined December 2025, with CVE-2025-55182 leading the pack ahead of CVE-2015-4040 and CVE-2025-59718/19. Attackers are optimizing for repeatable access at scale, often recycling "old but everywhere" flaws because they remain consistently exposed. The critical blind spot here is the remediation gap: with Auth/SSO weaknesses, access often survives the patch—adversaries can maintain persistence through valid tokens or established sessions even after the vulnerability is technically fixed. Prioritize internet-facing systems, but immediately follow up by invalidating sessions, rotating keys, and reviewing conditional access policies.
Post summary
The tweet highlights that CVE-2025-55182 and related flaws are being actively exploited, with attackers maintaining access via session tokens even after patches; it urges immediate session invalidation and key rotation.