> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
CVSSv3 Score:
5.2
An insufficiently protected credentials vulnerability [CWE-522] in FortiExtender may allow an authenticated user to obtain administrator credentials via debug log commands.
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
5.0
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in FortiSandbox may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file.
Revised on 2025-11-18 00:00:00
The flaw was reported by Google's Threat Analysis Group and was likely exploited by a commercial spyware vendor.
The post Chrome 142 Update Patches Exploited Zero-Day appeared first on SecurityWeek.
CVSSv3 Score:
4.9
An active debug code vulnerability [CWE-489] in FortiClientWindows may allow a local attacker to run the application step by step and retrieve the saved VPN user password
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
3.9
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiADC Logs may allow an admin with read-only permission to get the external resources password via the logs of the product.
Revised on 2025-11-18 00:00:00
Introduction
CVSSv3 Score:
6.7
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.Fortinet h...
CVSSv3 Score:
6.3
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
Revised on 2025-11-18 00:00:00
CISOs have a burgeoning identity crisis on their hands.
According to Verizon’s 2025 Data Breach Investigation Report, cyber attackers have switched up their initial access vectors of choice, with stolen credentials a leading cause of data breaches, triggering 22% of all int...
CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiVoice may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Revised on 202...
CVSSv3 Score:
6.9
A stack-based overflow vulnerability [CWE-124] in FortiOS CAPWAP daemon may allow a remote unauthenticated attacker on an adjacent network to achieve arbitrary code execution via sending specially crafted packets. Note that in the default configuration, the attacker must...
India’s Digital Personal Data Protection Act (DPDP), 2023, signaled the country’s commitment to building a modern and globally aligned privacy framework. But as with any legislation, the true operational impact becomes clear only when detailed rules are published. With the release of the Digital Per...
CVSSv3 Score:
6.9
A stack-based overflow vulnerability [CWE-124] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a remote authenticated attacker to execute arbitrary code or command as a low privileged user via specially crafted packets.Successful exploitation would require a la...
CVSSv3 Score:
1.8
An Improper Privilege Management vulnerability [CWE-269] in FortiOS, FortiProxy and FortiPAM may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.
Revised on 2025-11-18 00:00:00
SANTA CLARA, Calif., Nov 18, 2025 — International Data Corporation (IDC) officially released the “2025 IDC China Top 10 Cybersecurity Professionals” at the 10th IDC China CIO Summit last month. This honor is intended to recognize outstanding individuals who have made significant contributions to Chi...
CVSSv3 Score:
4.8
A use of hard-coded credentials vulnerability [CWE-798] in the internal redis services in FortiWeb may allow an authenticated attacker with shell access to the device to connect to any running redis service and access its data
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
4.2
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiADC virtual server's default error page may allow an unauthenticated attacker to execute malicious code via crafted URL.
Revised on 2025-11-18 00:00:00...
Dutch police seized 250 servers running a bulletproof hosting service tied to cybercriminals and linked to over 80 investigations since 2022. Dutch police Politie, seized 250 servers running an unnamed bulletproof hosting service used solely by cybercriminals. Active since 2022, it appeared in over...
Cybersecurity is no longer just an IT issue; it is a strategic imperative that touches every aspect of modern business. In today’s digital landscape, organizations face increasingly sophisticated threats that can disrupt operations, tarnish reputations, and lead to significant financial losses. A un...
AI-powered chatbots raise profound concerns under federal and state wiretapping and eavesdropping statutes that is being tested by recent litigation, creating greater exposure to the companies and developers that use this technology. Security professionals that integrate AI-chatbots into their busin...