Digest · Friday

Security digest: December 19, 2025

1 editorial brief and 1 known exploited (cisa kev) addition.

All digests · RSS · Markdown

Take stock

Patch this week: MongoBleed. Anyone running self-managed MongoDB 3.6 through 8.2.2, especially instances reachable from the internet or from shared or untrusted networks.
Do you run any of these? WatchGuard Firebox. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-26.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

Dec 19, 2025 · Vulnerability · CVE-2025-14847

MongoBleed: Pre-Auth Memory Leak in MongoDB Server

Atlas users are already patched; self-hosted MongoDB that untrusted networks can reach must be upgraded (or have zlib disabled) now, and internet-exposed instances should rotate credentials.

Must act: Anyone running self-managed MongoDB 3.6 through 8.2.2, especially instances reachable from the internet or from shared or untrusted networks.

Can relax: MongoDB Atlas customers (patched by MongoDB before disclosure) and self-hosted servers already on 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 or 4.4.30.

Check every self-managed node's version: mongod --version or db.version() in mongosh
Upgrade to the fixed release in your branch; move 3.6/4.0/4.2 deployments to a supported, patched branch
If you cannot upgrade immediately, remove zlib: start mongod/mongos with --networkMessageCompressors snappy,zstd (or set net.compression.compressors: snappy,zstd)

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-14733	WatchGuard Firebox WatchGuard Firebox Out of Bounds Write Vulnerability Ransomware	2025-12-26

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.