The medium-severity vulnerability, tracked as CVE-2025-58034, carries a CVSS score of 6.7 out of a maximum of 10.0. https://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html

Tracked as CVE-2025-58034, this OS command injection flaw can allow authenticated threat actors to gain code execution in low-complexity attacks that don't require user interaction. https://www.bleepingcomputer.com/news/security/cisa-gives-govt-agencies-7-days-to-patch-new-fortinet-flaw/

CVE-2025-58034 has been added to the CISA KEV Catalog

Vuln: Fortinet FortiWeb OS Command Injection Vulnerability

https://darkwebinformer.com/cisa-kev-catalog/

(Otra) vulnerabilidad en FortiWeb. Ahora una inyección de código (CVE-2025-58034)

Vía: @seguinfo

https://blog.segu-info.com.ar/2025/11/otra-vulnerabilidad-en-fortiweb-ahora.html

Google warnt vor aktiven Angriffen auf eine kritische Sicherheitslücke in Chrome. Nutzer sollen das bereitgestellte Update umgehend installieren. Auch andere Browser könnten betroffen sein.

#chrome #sicherheit

https://www.connect.de/news/chrome-update-142-0-7444-175-176-cve-2025-13223-13224-3211233.html

https://winbuzzer.com/2025/11/19/google-issues-emergency-chrome-update-to-patch-active-zero-day-exploit-xcxwbn

Google Issues Emergency Chrome Update to Patch Active Zero-Day Exploit

#GoogleChrome #CyberSecurity #ZeroDay #InfoSec #Google #V8Engine #Exploit #BrowserSecurity #CVE202513223 #OnlineSafety

CVE-2025-13223: Google Chromium V8 Type Confusion Vulnerability has been added to the CISA KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVSS: 8.8

Google Chrome, un altro bug critico risolto. Basta una pagina HTML contraffatta per sfruttarlo

Google ha rilasciato nuovi aggiornamenti per il suo browser Chrome nel mezzo di una nuova ondata di attacchi in cui gli aggressori sfruttano una falla nel motore V8. L’azienda ha riconosciuto che una delle vulnerabilità scoperte è già utilizzata in incidenti reali, quindi le patch sono state rilasciate immediatamente.

Il problema principale era il CVE-2025-13223, con severity di 8,8. Si tratta di un bug che può portare alla corruzione della memoria. In uno scenario di successo, un aggressore remoto potrebbe eseguire codice arbitrario tramite una pagina HTML appositamente creata.

Il problema è stato segnalato da Clement Lessin del team Threat Analysis Group, che ha identificato il problema il 12 novembre. L’azienda non ha rivelato chi potrebbe essere stato preso di mira dagli attacchi né la loro portata, ma conferma che esiste già uno strumento antimalware funzionante.

Questo bug è diventato la terza anomalia attiva di questa classe nella V8 di quest’anno, unendosi a CVE-2025-6554 e CVE-2025-10585 . È stato risolto anche un problema simile nel motore, CVE-2025-13224. È stato scoperto dall’agent di intelligenza artificiale interno di Google, Big Sleep .

Entrambi i bug hanno ricevuto lo stesso livello di gravità a causa del rischio di esecuzione di azioni arbitrarie nel sistema.

L’azienda ricorda che, inclusa la versione di novembre, il numero di vulnerabilità zero-day risolte in Chrome dall’inizio dell’anno ha raggiunto quota sette. L’elenco include CVE-2025-2783 , CVE-2025-4664 , CVE-2025-5419 , CVE-2025-6554 , CVE-2025-6558 e CVE-2025-10585 .

Per ridurre i rischi, consigliamo di installare le versioni più recenti di Chrome: 142.0.7444.175 o .176 per Windows, 142.0.7444.176 per macOS e 142.0.7444.175 per Linux.

È possibile verificare la presenza di aggiornamenti andando su Aiuto > Informazioni su Google Chrome e riavviando il browser. Anche gli utenti di Edge, Brave, Opera e Vivaldi dovrebbero attendere il rilascio degli aggiornamenti corrispondenti nelle loro build.

L'articolo Google Chrome, un altro bug critico risolto. Basta una pagina HTML contraffatta per sfruttarlo proviene da Red Hot Cyber.

🚨CVE-2025-11001: Active Exploitation Reported in 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

CVSS: 7.0

PoC: https://github.com/pacbypass/CVE-2025-11001

Write-up: https://pacbypass.github.io/2025/10/16/diffing-7zip-for-cve-2025-11001.html

RE: https://infosec.exchange/@cR0w/115577705920481071

One of these is now published:

https://www.cve.org/CVERecord?id=CVE-2025-11001

RE: https://infosec.exchange/@cR0w/115578517128494200

And it's reported to be EITW:

https://digital.nhs.uk/cyber-alerts/2025/cc-4719

Active exploitation of CVE-2025-11001 has been observed in the wild.

RE: https://infosec.exchange/@DarkWebInformer/115577677075391866

Did someone break embargo or what? These links are apparently for 0days for CVE-2025-11001 and CVE-2025-11002 but neither one of those are published as of right now.

https://www.cve.org/CVERecord?id=CVE-2025-11001

https://www.cve.org/CVERecord?id=CVE-2025-11002

This article details the exploitation of CVE-2025-9501, a pre-authentication Remote Code Execution (RCE) vulnerability in the W3 Total Cache WordPress plugin. Successful exploitation requires knowledge of the W3TC_DYNAMIC_SECURITY secret, enabled comments for unauthenticated users, and the Page Cache feature to be active.
https://www.rcesecurity.com/2025/11/exploiting-a-pre-auth-rce-in-w3-total-cache-for-wordpress-cve-2025-9501/

UPDATE: Blog's up => https://www.greynoise.io/blog/fortiweb-cve-2025-64446

-----

Trying to multitask (badly) but we are seeing exploitation slings against Fortinet FortiWeb CVE-2025-64446 (Auth Bypass).

https://viz.greynoise.io/tags/fortinet-fortiweb-cve-2025-64446-authentication-bypass-attempt?days=10

Def an "initial access broker"/"ransomware operator" vibe to the slings.

Will update this with blog link if/when it comes out today.

Hackers hacking more AI shit. I'm so proud.

https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet

Tl;Dr CVE-2023-48022 is EITW,

ShadowRay 2.0: Attackers Turn AI Against Itself in a Global Campaign That Hijacks AI Into a Self-Propagating Botnet
https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet

In early November 2025, the Oligo Security research team identified a new attack campaign exploiting the ShadowRay vulnerability (CVE-2023-48022) in Ray, a widely used open-source AI framework. This is the same flaw Oligo first observed being exploited in late 2023 and is now tracked by MITRE as ShadowRay, Campaign C0045.

In the latest activity, attackers used DevOps-style infrastructure and relied on GitLab to update and deliver region-aware malware. Oligo reported the activity to GitLab, and the malicious repository and account were removed on Nov. 5, 2025. However, Oligo has since confirmed that the attackers migrated to GitHub, where they created multiple accounts and repositories as of Nov. 10, 2025. The campaign remains active.

This new wave represents a major escalation from the initial ShadowRay exploitation. The threat actors, operating under the name IronErn440, are now weaponizing Ray’s legitimate orchestration features to support a self-propagating global cryptojacking operation capable of autonomously spreading across exposed Ray clusters.

ShadowRay 2.0 demonstrates how attackers are now leveraging AI-generated tooling to exploit exposed Ray clusters and create a globally distributed botnet.

Highlights:
• CVE-2023-48022 exploited across thousands of Ray servers
• LLM-generated scripts tailored to victim environments
• Region-aware updates via GitLab + GitHub
• Hidden GPU mining (A100 clusters)
• Competing cryptominers battling for compute
Thoughts on the broader implications for AI security?

Boost, reply, and follow @technadu for more deep-dive threat research.

#Infosec #CyberSecurity #ShadowRay #AIThreats #RayFramework #Botnet #ThreatHunting #CloudSecurity

[Palo Alto Networks CIO] emphasized that security cannot be an afterthought. "Security is much easier if you integrate [it] from the get go as a design principle, rather than trying to use it like a seasoning at the end of preparation of that food," she said. "It is not going to taste [as] well."

Yes, that's the same Palo Alto Networks responsible for such hits as CVE-2024-3400 and actively refusing to enable the ability to block ASNs in their firewalls.

https://www.paloaltonetworks.com/blog/2025/11/cio-why-security-must-be-built-into-ai/

🚨 Plugin update: PaloAltoPlugin (CVE-2024-3400, CVE-2025-0133).

PaloAlto PAN-OS XSS vulnerability detection added - GlobalProtect portal affected.

Results: https://leakix.net/search?q=%2Bplugin%3APaloAltoPlugin&scope=leak

Ouch:

"I stumbled upon a bug in RNP that has been introduced when refactoring. Namely, session keys generated for PKESK are not randomized but always zero."

#RNP is #Thunderbird's implementation of #OpenPGP. This is CVE-2025-13402, best link I found so far is https://bugzilla.redhat.com/show_bug.cgi?id=2415863.