Widespread exploitation of MongoBleed dominated activity, with CVE-2025-14847 enabling unauthenticated access to memory and sensitive secrets. Public exposure at scale reflected direct abuse against internet-facing MongoDB deployments.

Platform abuse featured prominently after Ubisoft confirmed a breach impacting Rainbow Six Siege operations. Attackers leveraged internal systems to alter moderation workflows, issue bans, and distribute large volumes of in-game currency across accounts.

Claims of large-scale data exposure extended to media, following an alleged Condé Nast compromise involving WIRED subscriber records. The incident centred on a database containing millions of entries, with further disclosures threatened across additional brands.

Malware activity continued with the appearance of a new Shai Hulud strain observed in active circulation. The variant aligned with ongoing campaigns attributed to the family throughout 2025.

MongoDB disclosed a high-severity vulnerability, tracked as CVE-2025-14847, affecting its server’s zlib compression handling. The flaw allows unauthenticated remote clients to read uninitialised heap memory, potentially exposing sensitive internal data across a wide range of MongoDB versions.

The issue arises from inconsistent length handling in compressed protocol headers and carries a CVSS score of up to 8.7. MongoDB has released patched versions after confirming the vulnerability affects both supported and legacy releases.

Ubisoft confirmed a breach affecting Rainbow Six Siege that allowed attackers to manipulate internal moderation systems and distribute vast amounts of in-game currency and items. The incident led to player bans being falsely issued, premium credits being granted globally, and the temporary shutdown of game servers and the in-game marketplace.

Ubisoft stated that affected transactions would be rolled back and that players would not be penalised for spending the credits. The company has not disclosed technical details on how the breach occurred.

A previously unseen strain of the Shai Hulud malware was identified in an npm package, indicating continued evolution of the threat. Analysis shows changes to payload structure, data exfiltration behaviour, and error handling, suggesting access to the original malware source code rather than imitation.

The package was removed shortly after publication, and no widespread infections were observed at the time of discovery. Researchers described the activity as limited testing rather than a large-scale campaign.