The IT Nerd

With the holidays right around the corner, and cybercriminals’ activity increasing during business downtime, it is more important than ever for organizations and individuals both to take practical steps to protect themselves from potential cyber-attacks. 

Noé Mantel, Cybersecurity Specialist at Outpost24, has shared the following tips for how to do just that:

Tip #1: Check the reliability of your backups 

Before going on holiday, it is essential to ensure that critical backups are up to date, functional, and stored offline. Organizations should systematically test their data recovery procedures and ensure that no backups are stored on the same network as production systems to prevent ransomware from encrypting or deleting them. 

Tip #2: Apply updates and patches before the holidays 

The end of the year is an ideal time to deploy pending patches and update obsolete software. Regular vulnerability analysis allows you to prioritize risks and fix systems exposed to the internet or close to critical assets first. A centralized patch management system, based on risk assessment, is an essential pillar of effective security. 

Tip #3: Strengthen your network security 

Multi-layered segmentation limits an attacker’s lateral movement in the event of an intrusion. Filtering malicious IP addresses, using URL whitelists, and closing unnecessary ports are simple actions that greatly reduce the attack surface. Regular traffic analysis also helps identify potential anomalies. 

Tip #4: Closely monitor the most exposed services 

Remote access such as RDP and VPNs must be protected by automatic locking mechanisms and monitored via connection logs. It is also recommended to disable all unused ports and to check the security practices of third-party service providers and employees working remotely. 

Tip #5: Avoid public USB ports when travelling 

Juice jacking remains an emerging and little-known threat. Companies must educate their teams never to use public charging ports in train stations, hotels or airports. A personal mains charger or external battery is the safest alternative. 

Tip #6: Adopt rigorous identity and access management 

Identity control is central to protecting infrastructure. IAM provides complete visibility into users, their permissions and their login behavior. Contextual analysis and artificial intelligence make it easier to detect anomalies without imposing overly restrictive rules. 

Tip #7: Strengthen your passwords and MFA 

The implementation of unique, sufficiently complex and regularly renewed passwords remains a fundamental aspect of cybersecurity. The use of password managers and the systematic adoption of multi-factor authentication significantly reduce the risk of compromise. Tools that block compromised passwords further strengthen this essential barrier. 

Researchers at Outpost24 have published a new analysis on the recent 700Credit breach. This analysis dives into the origin of this breach and the database’s appearance on the darkweb.  I covered this news previously here.

Here’s the link to the analysis: https://outpost24.com/blog/700credit-data-breach/

It is being reported that a ransomware gang is exploiting the critical React2Shell vulnerability (CVE-2025-55182) to gain initial access to corporate networks and deploy the file-encrypting malware less than a minute later.

Outpost24 researchers just recently published an in-depth look at the React2Shell vulnerability, diving into what exactly the vulnerability is, how the exploit works, its exploitation characteristics, as well as practical detection, remediation tips, and risk management implications. 

The team commented, “The RSC model is designed to let servers return rendered UI fragments to clients efficiently. Behind this capability is a serialization and deserialization protocol, often called the Flight protocol that encodes component data and function calls for transport between client and server.

The React2Shell vulnerabilities arise because the deserialization logic in the Flight protocol does not validate untrusted data fully. When a server receives a maliciously crafted Request payload, the decoder may incorporate attacker-controlled values into internal objects and execution paths. This missing validation allows an attacker to control execution flow and trigger arbitrary code execution in the server process context.

Since Next.js builds on the same underlying React RSC infrastructure, applications that include RSC support (especially with the App Router) are also affected unless they have been updated to include the patched React implementation.”

For full details, the analysis can be found here: https://outpost24.com/blog/react2shell-cve-2025-55182-react-vulnerability/

Outpost24 today announced a new investment from Vitruvian Partners to fuel its next phase of global growth. This significant new funding will accelerate innovation across the company’s platform, with a focus on integrating AI capabilities to optimize how security teams identify and neutralize critical vulnerabilities.

The only European vendor recognized as an overall leader in the 2025 KuppingerCole Leadership Compass Report for Attack Surface Management, Outpost24 delivers a distinct approach to cyber defence that empowers security teams to gain a complete understanding of their digital and human risk landscape.

Last week, Outpost24 announced the acquisition of Infinipoint, a specialist in device identity, posture validation, and secure workforce access. The acquisition marks the company’s entry into the Zero Trust Workforce Access market and lays the foundation for its identity security division, Specops, to offer a unified approach that evaluates both the user and the device before access is granted. Through the strategic integration of its solutions — spanning external risk, identity, and device trust — Outpost24 is setting a new standard for cybersecurity. The company’s roadmap is focused on next-generation AI capabilities to catapult businesses forward, enabling them to prioritize the most critical threats and secure their assets.

The recent acquisition followed by today’s funding announcement mark the conclusion of a stellar year for Outpost24. Earlier this year, the company launched CyberFlex, a flexible, next-generation solution that integrates External Attack Surface Management and Penetration Testing as a Service (PTaaS) to help organizations efficiently manage and secure external-facing applications. Built on a pay-as-you-go credit model, CyberFlex embodies the shift toward consumable cybersecurity — giving customers the flexibility to dynamically allocate testing resources, scale coverage, and control costs as their security priorities evolve.

With over two decades of expertise, a strong European foundation, and thousands of customers worldwide, Outpost24 is expertly positioned to help organizations stay ahead of evolving cyber threats. By combining its leading Attack Surface Management platform with Specops’ specialized identity and password security, and the newly added strength of device identity and secure workforce access, Outpost24 delivers a truly comprehensive security picture that moves beyond conventional scanning methods. This empowers security teams to instantly identify, prioritize, and remediate the most critical risks, fundamentally strengthening resilience across both digital and human attack surfaces.