5 Threats That Defined Security in 2025

2025’s top security stories include continued China-nexus APT Salt Typhoon espionage against telecoms and the US National Guard, the disclosure and rapid exploitation of React2Shell (CVE-2025-55182, CVSS 10) affecting widely deployed React Server Components, the emergence of Shai-Hulud — a self-replicating infostealer that poisons open-source packages — and supply-chain attacks abusing Salesloft/GitHub access to compromise hundreds of Salesforce instances; the report also highlights CISA budget cuts that weaken public-sector defenses.