CulperSec

The CMMC Phase II suspension is not a compliance vacation.

Some third-party assessment pressure has been paused, but the responsibility to protect CUI has not. Self-assessments continue. DFARS 252.204-7012 still applies. Incident reporting requirements remain in force.

For small and midsize defense contractors, stopping now could create expensive gaps that are difficult to explain or rebuild later.

Our latest article breaks down what changed, what did not, and how contractors can use the pause to strengthen their CUI scope, SSP, POA&M, evidence, and incident response procedures.

Read the full analysis:
https://culpersec.com/blog/cmmc-phase-ii-suspension-smb-defense-contractors

CMMC Phase II suspension: what SMB defense contractors should keep doing The CMMC Phase II suspension pauses some third-party pressure, not CUI duties. Here is what SMB defense contractors should review and document.

Critical security alert for organizations running React Server Components and modern frameworks that implement RSC (including Next.js, React Router, Expo, Waku, Redwood SDK, Vite/Parcel RSC and others).

The React team has disclosed CVE-2025-55182, a CVSS 10.0 unauthenticated remote code ex*****on vulnerability in React Server Components. Patched React and framework versions are now available and should be treated as an emergency upgrade, not a routine patch.

Read the official advisory and upgrade instructions:
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

CulperSec’s security engineering team is actively reviewing customer environments, and validating mitigations across our CulperIQ customers. If your organization needs help:

• Determining whether your apps are exposed
• Prioritizing and rolling out framework upgrades
• Adding monitoring and compensating controls around affected services

Contact us at [email protected] today

Critical Security Vulnerability in React Server Components – React The library for web and native user interfaces