![Patch [FIX] Tuesday – December 2025 [React2Shell, Holiday Distractions, and High-Risk RCEs], E26](https://img.transistorcdn.com/DSzCr2RBCuYvUp0Z5L76uophZQ-KwJNwoQb_ZYWWDrs/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS81NWQ5/OTMzNzhhNTAxYTJl/N2ExMTQzYzczMjNl/NTAxNS5wbmc.jpg "Patch [FIX] Tuesday – December 2025 [React2Shell, Holiday Distractions, and High-Risk RCEs], E26")
Patch [FIX] Tuesday – December 2025 [React2Shell, Holiday Distractions, and High-Risk RCEs], E26
Description
Attackers don’t take holidays off. In this December Patch Tuesday episode, the Automox security team breaks down three high-impact vulnerabilities landing at the end of 2025. Ryan, Mat, and Seth unpack the React2Shell RCE hitting React Server Components, an Azure Monitor Agent flaw that turns the syslog user into a stealthy foothold, and a Windows File Explorer bug where a single click may trigger privilege escalation.
You’ll hear why light patch months aren’t always low-risk, how bundled dependencies can expose you even if you don’t “use” React, and why log pipelines remain a prime target for attackers looking to hide their tracks. The team also covers seasonal phishing trends and what to expect as skeleton crews head into the holidays.
![Patch [FIX] Tuesday – November 2025 [Kernel Flaws, WSL Priv-esc, and the Agentic AI Developer Risk Frontier], E25](https://img.transistorcdn.com/703lDU8UCnjC2b3sTr8uAV54dMIoW54TE0v19eocRO8/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9hMTEy/MGUzMjMxMDE2YTFh/M2M0ZDkxZmU1YjY1/Mzg5Ni5wbmc.jpg "Patch [FIX] Tuesday – November 2025 [Kernel Flaws, WSL Priv-esc, and the Agentic AI Developer Risk Frontier], E25")
![Patch [FIX] Tuesday – October 2025 [Game Engine Gremlins, Windows Hello Attacks, and Exchange Exploits], E24](https://img.transistorcdn.com/2eXDtA8g0OpzTiaHTmEvsTUixhGIoz9QamFSRRy-Iq4/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9iNDJm/ODQxYWJmMWQyNDhl/MTM0Y2ZkZjI1NjU5/OTJmNi5wbmc.jpg "Patch [FIX] Tuesday – October 2025 [Game Engine Gremlins, Windows Hello Attacks, and Exchange Exploits], E24")
United States
