A week in security (December 15 – December 21)

Malwarebytes Labs’ weekly roundup, published on 22 December 2025, highlights a busy period for cybersecurity news from 15 to 21 December. The article notes a run of notable items, including CISA warns ASUS Live Update backdoor is still exploitable, seven years on, according to CISA, underscoring how long some firmware flaws persist.

It also covers the ghosts of WhatsApp: How GhostPairing hijacks accounts, the Chrome flaws that could be triggered by simply browsing the web, and two Chrome issues that Google has patched. Additional entries include Inside a purchase order PDF phishing campaign, data breaches at SoundCloud, Pornhub, and 700Credit, and Android mobile adware surging in the second half of 2025.

The roundup also references a photo booth flaw exposing private pictures online, Google's discontinuation of its dark web report, and PayPal closing a loophole that let scammers send real emails with fake purchase notices.