The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.
The list of vulnerabilities is as follows –
CVE-2025-68645 (CVSS score: 8.8) – A PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that could allow a remote attacker to craft requests to the “/h/rest” endpoint and allow inclusion of arbitrary files from the WebRoot directory without any authentication (Fixed in November 2025 with version 10.1.13)
CVE-2025-34026 (CVSS score: 9.2) – An authentication bypass in the Versa Concerto SD-WAN orchestration platform that could allow an attacker to access administrative endpoints (Fixed in April 2025 with version 12.2.1 GA)
CVE-2025-31125 (CVSS score: 5.3) – An improper access control vulnerability in Vite Vitejs that could allow contents of arbitrary files to be returned to the browser using ?inline&import or ?raw?import (Fixed in March 2025 with versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11)
CVE-2025-54313 (CVSS score: 7.5) – An embedded malicious code vulnerability in eslint-config-prettier that could allow for execution of a malicious DLL dubbed Scavenger Loader that’s designed to deliver an information stealer
It’s worth noting that CVE-2025-54313 refers to a supply chain attack targeting eslint-config-prettier and six other npm packages, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, got-fetch, and is, that came to light in July 2025.
The phishing campaign targeted the package maintainers with bogus links that harvested their credentials under the pretext of verifying their email address as part of regular account maintenance, allowing the threat actors to publish trojanized versions.
According to CrowdSec, exploitation efforts targeting CVE-2025-68645 have been ongoing since January 14, 2026. There are currently no details on how the other vulnerabilities are being exploited in the wild.
Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by February 12, 2026, to secure their networks against active threats.
Sarah RainsfordEastern Europe correspondent , Kyiv
Getty Images
Ukraine wants peace more than anyone in this process
Negotiators from Russia, Ukraine and the US are meeting in Abu Dhabi for their first trilateral talks since Russia’s full-scale invasion of Ukraine in 2022, the United Arab Emirates Foreign Ministry says.
Senior officials from all three nations are involved, but it is unclear whether they will be in the same room together at any point. And whilst the talks take a new format, the core differences remain the same.
The stakes are high, but expectations are limited.
Donald Trump is pushing hard for a peace deal in Ukraine – the one he promised but hasn’t yet delivered – and he said this week that the two sides would be “stupid” if they couldn’t agree.
But despite some intense shuttle diplomacy by his own envoys, they are hosting the first trilateral talks between Ukrainian and Russian negotiators with some major issues still unresolved.
Ukraine is engaging with the process because it wants peace more than anyone, but also because it needs to keep the US onside. It learned that lesson the hard way last year, when Donald Trump briefly suspended intelligence sharing and military aid.
Now, Ukraine’s President Volodymyr Zelensky says his talks with Trump in Davos were “really positive” and he hopes for more air defence support against Russia’s relentless attacks as a result.
Often grim-faced after his encounters with the US leader, this time Zelensky seemed unusually upbeat.
But he remains cautious on the outcome of talks in the United Arab Emirates.
He’s described the meetings, which may last two days, as “a step”, but shied away from calling it a positive one.
“We have to wish it will push us a bit closer to peace,” is how he put it.
For a while, Zelensky has talked about being 90% of the way to producing a framework deal for peace, but the final 10% was always going to be the hardest – and Russia could still reject the whole thing.
“It’s all about the eastern part of our country. It’s all about the land. This is the issue that’s not resolved yet,” he explained, spelling out the biggest obstacle that he says still remains.
Russia insists that Ukraine should hand over the big slice of the eastern Donbas region, which it has failed to win on the battlefield. Ukraine refuses.
Politicians often talk about their red lines, but for this country the line in the Donbas is drawn with the blood of the soldiers who died defending it.
Zelensky can’t cross it.
As I write this, the music from another soldier’s funeral is drifting up from a church in the street.
On my way back into Ukraine this time, we drove passed so many military graves in roadside cemeteries, all marked with flags.
The other big issue up for discussion in the UAE is what the US would do, militarily, if Russia were to invade Ukraine again someday. That’s what Ukraine calls its “security guarantees”, and says are essential.
Zelensky says the deal between the US and Ukraine is done, but we have no real details.
Russia’s response also remains a wide-open question.
Getty Images
Recent Russian strikes have left parts of Kyiv without power or water amid freezing temperatures
There’s also the giant new doubt about how good a guarantee from Donald Trump really is: the US president’s fixation on “acquiring” Greenland has severely undermined Nato.
He’s also undermined the very principle of protecting a nation’s sovereignty, the whole basis for Western support for Ukraine.
So can Kyiv trust him to come to the rescue in the next crisis? For now, it doesn’t have much choice.
As for trusting Vladimir Putin, no one here is under any illusions that his aims have changed.
“He really doesn’t want it,” is what Zelensky said in Davos about Putin and peace.
The Kremlin has said that if it doesn’t get what it wants at the talking table, it will “achieve its aims on the battlefield” – though it’s failed so far, despite sacrificing huge number of soldiers.
So once again, it’s targeting civilian infrastructure across the country – but in a more deliberate, sustained, and devastating way than ever before.
In the depths of a bitter winter, that’s left people freezing in their homes.
Today, the mayor of Kyiv again called on city residents to leave if they have somewhere to go.
“The enemy will most likely continue to attack the critical infrastructure of the city and the country,” Vitali Klitschko warned.
After repeat attacks, the system is very fragile.
“I address the residents and say honestly: the situation is extremely difficult and this may not be the most difficult moment yet.”
Nawal Al-MaghafiSenior international investigations correspondent, Yemen
Liam weir / BBC
One of the sites had several shipping containers with little ventilation, where detainees said up to 60 men were held
The BBC has been given access to detention facilities on former United Arab Emirates military bases in Yemen, confirming long-standing allegations of a network of secret prisons run by the UAE and forces allied to it in Yemen’s decade-long civil war.
One former detainee told the BBC he had been beaten and sexually abused at one of the sites.
We saw cells at two bases in the south of the country, including shipping containers with names – apparently of detainees – and dates scratched into the sides.
The UAE did not respond to our request for comment, but has previously denied similar allegations.
Until recently, the Yemeni government, which is backed by Saudi Arabia, was allied with the UAE against the Houthi rebel movement which controls north-west Yemen.
But the alliance between Yemen’s two Gulf state partners has fractured. UAE forces pulled out of Yemen in early January and Yemeni government forces and groups allied to them have retaken large swathes of the south from separatists backed by the UAE.
This includes the port of Mukalla, where we landed in a Saudi military plane and were taken to visit the former UAE military bases in the Al-Dhaba Oil Export Area.
It has been almost impossible for international journalists to get visas to report from Yemen in recent years, but the government invited reporters to view the two sites, accompanied by Yemen’s Information Minister Moammar al-Eryani.
What we saw was consistent with accounts we have gathered independently, both in our previous reporting and also interviews conducted in Yemen, separately from the government-run site visit.
‘No space to lie down’
At one site, there were about 10 shipping containers, their interiors painted black, with little ventilation.
Messages on the walls appeared to mark the dates detainees said they were brought in, or to count the number of days they had been held.
Several were dated as recently as December 2025.
At another military base, the BBC was shown eight cells built from brick and cement, including several measuring about one metre square and two metres tall, which Eryani said were used for solitary confinement.
Liam Weir / BBC
One site had several cells that were about a metre square, which the Yemeni government said were used for solitary confinement
Human rights groups have documented testimony describing such facilities for years.
Yemeni lawyer Huda al-Sarari has been gathering accounts.
The BBC independently attended a meeting she organised, where about 70 people were present who said they had been held in Mukalla, as well as the families of another 30 who they said their relatives were still in detention.
Several former detainees told us that each shipping container could hold up to 60 men at a time.
They said prisoners were blindfolded, bound at the wrists and forced to remain sitting upright at all hours.
“There was no space to lie down,” one former prisoner told the BBC. “If someone collapsed, the others had to hold him up.”
‘All types of torture’
The man also told the BBC he was beaten for three days after his arrest, with interrogators demanding he confess to being a member of al-Qaeda – an accusation he denies.
“They told me if I didn’t admit it, I would be sent to ‘Guantanamo’,” he said, referring to the US military detention centre at Guantanamo Bay in Cuba.
“I didn’t even know what they meant by Guantanamo until they took me to their prison. Then I understood.”
He said he was held there for a year and a half, beaten daily and abused.
“They didn’t even feed us properly,” he said. “If you wanted the toilet, they took you once. Sometimes you were so desperate you did it on yourself.”
He says his captors included Emirati soldiers as well as Yemeni fighters: “All types of torture – when we were interrogated it was the worst. They even sexually abused us and said they would bring in the ‘doctor’.
“This so-called doctor was Emirati. He beat us and told the Yemeni soldiers to beat us too. I tried to kill myself multiple times to make it end.”
Liam Weir / BBC
Dates were scratched into the black sides of the shipping containers
The UAE was leading a counter-terror campaign in southern Yemen, but human rights groups say thousands of people were detained in crackdowns on political activists and critics.
A mother told us her son was detained as a teenager and has been held for nine years.
“My son was an athlete,” she said. “He had just come back from competing abroad. That day he went to the gym and never came back.”
“I didn’t hear from him for seven months,” she said.
“Then they let me see him for 10 minutes. I could see all the scars of the torture.”
She alleged that in the prison at the Emirati-run base, her teenage son was electrocuted, doused with ice-cold water and sexually abused multiple times.
She says she attended a hearing in which her son’s accusers played a recording of him apparently confessing.
“You can hear him being beaten in the background and told what to say,” she said. “My son is not a terrorist. You have robbed him of the best years of his life.”
Testimony and allegations
Over the past decade, human rights groups and media organisations – including the BBC and Associated Press – have documented allegations of arbitrary detention, enforced disappearance and torture in detention centres run by the UAE and its allies.
Human Rights Watch said in 2017 it had gathered testimonies of detainees held without charge or judicial oversight in unofficial facilities, and subjected to beatings, electric shocks and other forms of ill treatment.
The UAE denied these allegations when they were made.
The BBC sent detailed allegations to the UAE government about the detention sites we visited and accounts of abuse, but received no response.
All sides have been accused of human rights violations in the civil war, which has sparked a devastating humanitarian crisis in the country.
Families’ questions
Fadel SENNA / AFP via Getty Image
Minister Moammar al-Eryani said victims had told the government the prisons existed, “but we didn’t believe it was true”
Families of detainees told the BBC they had repeatedly raised concerns with Yemeni authorities.
They believe it would have been impossible for the UAE and its allies to run a detention network without the Yemeni government and its Saudi backers knowing about it.
The information minister, Eryani, said: “We weren’t able to access locations that were under UAE control until now.
“When we liberated them we discovered these prisons… we had been told by many victims that they existed but we didn’t believe it was true.”
His government’s decision to give access to international media comes as the rift between Saudi Arabia and the UAE is widening.
Their long-strained relationship deteriorated in December when UAE-backed southern separatists, the Southern Transition Council (STC), seized territory controlled by government forces in two western provinces.
Saudi Arabia then carried out a strike on what it said was a shipment of weapons from the UAE to the STC in Mukalla, and backed a demand from Yemen’s presidential council for Emirati forces to leave the country immediately.
The UAE withdrew and within days government forces and their allies retook control of the western provinces as well as all of the south.
However, remaining separatists threaten the government’s position in some places, including the southern port of Aden.
The UAE denied that the shipment had contained weapons and also Saudi allegations that it was behind the STC’s recent military campaign.
Detainees ‘still held’
Fadel SENNA / AFP via Getty Images
Mukalla was controlled by forces allied to the UAE until early January
On 12 January 2026, the president of Yemen’s Presidential Leadership Council, which oversees the government, Rashad al-Alimi, ordered the closure of all “illegal” prisons in southern provinces previously controlled by the STC, demanding the immediate release of those “held outside the framework of the law”.
Eryani said some detainees had been discovered inside the facilities, but did not give numbers or further details.
Some relatives – including the mother of the athlete – told the BBC that detainees have since been transferred to prisons now nominally under government control.
Yemeni authorities say transferring prisoners into the formal justice system is complex, while rights groups warn arbitrary detention may simply continue under different control.
“The terrorists are out on the streets,” the mother said.