Overview
Description
Statistics
- 18 Posts
- 3 Interactions
Fediverse
The medium-severity vulnerability, tracked as CVE-2025-58034, carries a CVSS score of 6.7 out of a maximum of 10.0. https://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html
Tracked as CVE-2025-58034, this OS command injection flaw can allow authenticated threat actors to gain code execution in low-complexity attacks that don't require user interaction. https://www.bleepingcomputer.com/news/security/cisa-gives-govt-agencies-7-days-to-patch-new-fortinet-flaw/
CVE-2025-58034 has been added to the CISA KEV Catalog
Vuln: Fortinet FortiWeb OS Command Injection Vulnerability
(Otra) vulnerabilidad en FortiWeb. Ahora una inyección de código (CVE-2025-58034)
Vía: @seguinfo
https://blog.segu-info.com.ar/2025/11/otra-vulnerabilidad-en-fortiweb-ahora.html
Bluesky
Description
Statistics
- 10 Posts
- 4 Interactions
Fediverse
Google warnt vor aktiven Angriffen auf eine kritische Sicherheitslücke in Chrome. Nutzer sollen das bereitgestellte Update umgehend installieren. Auch andere Browser könnten betroffen sein.
https://www.connect.de/news/chrome-update-142-0-7444-175-176-cve-2025-13223-13224-3211233.html
Google Issues Emergency Chrome Update to Patch Active Zero-Day Exploit
#GoogleChrome #CyberSecurity #ZeroDay #InfoSec #Google #V8Engine #Exploit #BrowserSecurity #CVE202513223 #OnlineSafety
CVE-2025-13223: Google Chromium V8 Type Confusion Vulnerability has been added to the CISA KEV Catalog
https://darkwebinformer.com/cisa-kev-catalog/
CVSS: 8.8
Google Chrome, un altro bug critico risolto. Basta una pagina HTML contraffatta per sfruttarlo
Google ha rilasciato nuovi aggiornamenti per il suo browser Chrome nel mezzo di una nuova ondata di attacchi in cui gli aggressori sfruttano una falla nel motore V8. L’azienda ha riconosciuto che una delle vulnerabilità scoperte è già utilizzata in incidenti reali, quindi le patch sono state rilasciate immediatamente.
Il problema principale era il CVE-2025-13223, con severity di 8,8. Si tratta di un bug che può portare alla corruzione della memoria. In uno scenario di successo, un aggressore remoto potrebbe eseguire codice arbitrario tramite una pagina HTML appositamente creata.
Il problema è stato segnalato da Clement Lessin del team Threat Analysis Group, che ha identificato il problema il 12 novembre. L’azienda non ha rivelato chi potrebbe essere stato preso di mira dagli attacchi né la loro portata, ma conferma che esiste già uno strumento antimalware funzionante.
Questo bug è diventato la terza anomalia attiva di questa classe nella V8 di quest’anno, unendosi a CVE-2025-6554 e CVE-2025-10585 . È stato risolto anche un problema simile nel motore, CVE-2025-13224. È stato scoperto dall’agent di intelligenza artificiale interno di Google, Big Sleep .
Entrambi i bug hanno ricevuto lo stesso livello di gravità a causa del rischio di esecuzione di azioni arbitrarie nel sistema.
L’azienda ricorda che, inclusa la versione di novembre, il numero di vulnerabilità zero-day risolte in Chrome dall’inizio dell’anno ha raggiunto quota sette. L’elenco include CVE-2025-2783 , CVE-2025-4664 , CVE-2025-5419 , CVE-2025-6554 , CVE-2025-6558 e CVE-2025-10585 .
Per ridurre i rischi, consigliamo di installare le versioni più recenti di Chrome: 142.0.7444.175 o .176 per Windows, 142.0.7444.176 per macOS e 142.0.7444.175 per Linux.
È possibile verificare la presenza di aggiornamenti andando su Aiuto > Informazioni su Google Chrome e riavviando il browser. Anche gli utenti di Edge, Brave, Opera e Vivaldi dovrebbero attendere il rilascio degli aggiornamenti corrispondenti nelle loro build.
L'articolo Google Chrome, un altro bug critico risolto. Basta una pagina HTML contraffatta per sfruttarlo proviene da Red Hot Cyber.
Bluesky
Overview
Description
Statistics
- 12 Posts
- 16 Interactions
Fediverse
🚨CVE-2025-11001: Active Exploitation Reported in 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
CVSS: 7.0
PoC: https://github.com/pacbypass/CVE-2025-11001
Write-up: https://pacbypass.github.io/2025/10/16/diffing-7zip-for-cve-2025-11001.html
RE: https://infosec.exchange/@cR0w/115577705920481071
One of these is now published:
RE: https://infosec.exchange/@cR0w/115578517128494200
And it's reported to be EITW:
https://digital.nhs.uk/cyber-alerts/2025/cc-4719
Active exploitation of CVE-2025-11001 has been observed in the wild.
RE: https://infosec.exchange/@DarkWebInformer/115577677075391866
Did someone break embargo or what? These links are apparently for 0days for CVE-2025-11001 and CVE-2025-11002 but neither one of those are published as of right now.
Bluesky
Overview
Description
Statistics
- 5 Posts
- 3 Interactions
Fediverse
This article details the exploitation of CVE-2025-9501, a pre-authentication Remote Code Execution (RCE) vulnerability in the W3 Total Cache WordPress plugin. Successful exploitation requires knowledge of the W3TC_DYNAMIC_SECURITY secret, enabled comments for unauthenticated users, and the Page Cache feature to be active.
https://www.rcesecurity.com/2025/11/exploiting-a-pre-auth-rce-in-w3-total-cache-for-wordpress-cve-2025-9501/
Bluesky
Overview
Description
Statistics
- 4 Posts
- 7 Interactions
Fediverse
UPDATE: Blog's up => https://www.greynoise.io/blog/fortiweb-cve-2025-64446
-----
Trying to multitask (badly) but we are seeing exploitation slings against Fortinet FortiWeb CVE-2025-64446 (Auth Bypass).
https://viz.greynoise.io/tags/fortinet-fortiweb-cve-2025-64446-authentication-bypass-attempt?days=10
Def an "initial access broker"/"ransomware operator" vibe to the slings.
Will update this with blog link if/when it comes out today.
Bluesky
Overview
Description
Statistics
- 3 Posts
- 2 Interactions
Fediverse
ShadowRay 2.0: Attackers Turn AI Against Itself in a Global Campaign That Hijacks AI Into a Self-Propagating Botnet
https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet
In early November 2025, the Oligo Security research team identified a new attack campaign exploiting the ShadowRay vulnerability (CVE-2023-48022) in Ray, a widely used open-source AI framework. This is the same flaw Oligo first observed being exploited in late 2023 and is now tracked by MITRE as ShadowRay, Campaign C0045.
In the latest activity, attackers used DevOps-style infrastructure and relied on GitLab to update and deliver region-aware malware. Oligo reported the activity to GitLab, and the malicious repository and account were removed on Nov. 5, 2025. However, Oligo has since confirmed that the attackers migrated to GitHub, where they created multiple accounts and repositories as of Nov. 10, 2025. The campaign remains active.
This new wave represents a major escalation from the initial ShadowRay exploitation. The threat actors, operating under the name IronErn440, are now weaponizing Ray’s legitimate orchestration features to support a self-propagating global cryptojacking operation capable of autonomously spreading across exposed Ray clusters.
ShadowRay 2.0 demonstrates how attackers are now leveraging AI-generated tooling to exploit exposed Ray clusters and create a globally distributed botnet.
Highlights:
• CVE-2023-48022 exploited across thousands of Ray servers
• LLM-generated scripts tailored to victim environments
• Region-aware updates via GitLab + GitHub
• Hidden GPU mining (A100 clusters)
• Competing cryptominers battling for compute
Thoughts on the broader implications for AI security?
Boost, reply, and follow @technadu for more deep-dive threat research.
#Infosec #CyberSecurity #ShadowRay #AIThreats #RayFramework #Botnet #ThreatHunting #CloudSecurity
Overview
- astral-sh
- tokio-tar
Description
Statistics
- 2 Posts
- 1 Interaction
Fediverse
https://github.com/google/security-research/security/advisories/GHSA-9p78-p5g6-gcj8
This is CVE-2025-59825
Overview
Description
Statistics
- 3 Posts
- 14 Interactions
Fediverse
[Palo Alto Networks CIO] emphasized that security cannot be an afterthought. "Security is much easier if you integrate [it] from the get go as a design principle, rather than trying to use it like a seasoning at the end of preparation of that food," she said. "It is not going to taste [as] well."
Yes, that's the same Palo Alto Networks responsible for such hits as CVE-2024-3400 and actively refusing to enable the ability to block ASNs in their firewalls.
https://www.paloaltonetworks.com/blog/2025/11/cio-why-security-must-be-built-into-ai/
🚨 Plugin update: PaloAltoPlugin (CVE-2024-3400, CVE-2025-0133).
PaloAlto PAN-OS XSS vulnerability detection added - GlobalProtect portal affected.
Results: https://leakix.net/search?q=%2Bplugin%3APaloAltoPlugin&scope=leak
Overview
- isaacs
- node-glob
Description
Statistics
- 1 Post
- 2 Interactions
Overview
Description
Statistics
- 1 Post
- 2 Interactions
Fediverse
Ouch:
"I stumbled upon a bug in RNP that has been introduced when refactoring. Namely, session keys generated for PKESK are not randomized but always zero."
#RNP is #Thunderbird's implementation of #OpenPGP. This is CVE-2025-13402, best link I found so far is https://bugzilla.redhat.com/show_bug.cgi?id=2415863.