> TODAY'S SUMMARY (8 articles)
Today's cyber news highlights significant threats and vulnerabilities. The FBI has seized $1.2 billion in cryptocurrency linked to North Korean hackers, who are also implicated in a $400 million social engineering scheme. This operation involved using video call deception to trick victims. In software security, several vulnerabilities in Ubuntu products have been addressed, including fixes for x11vnc's insecure shared memory permissions, TigerVNC's server impersonation risks, and the signing-party's potential for executing malicious commands via crafted OpenPGP keys. Additionally, updates for SA-Exim and Ruby OpenID have been released to mitigate risks of unsafe rule evaluations and server-side request forgery, respectively.
|
// AI-powered summary generated at 04:01
Google patched two Chrome flaws, including a V8 type-confusion bug, tracked as including CVE-2025-13223, which was exploited in the wild. Google released Chrome security updates to address two flaws, including a high-severity V8 type confusion bug tracked as CVE-2025-13223 that has been actively exp...
Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 5.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps).
The tech giant said it was the largest D...
CVSSv3 Score:
7.1
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in FortiClient Windows may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as He...
CVSSv3 Score:
6.3
A buffer overflow vulnerability [CWE-120] in FortiExtender json_cli may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.
Revised on 2025-11-18 00:00:00
The flaw was reported by Google's Threat Analysis Group and was likely exploited by a commercial spyware vendor.
The post Chrome 142 Update Patches Exploited Zero-Day appeared first on SecurityWeek.
CVSSv3 Score:
7.1
A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiClient Windows may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys" driver. The attacker would need to bypass the Windows heap integrity protections.
Revi...
CVSSv3 Score:
3.9
A CRLF Header Injection vulnerability [CWE-93] in FortiMail user GUI may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link
Revised on 2025-11-18 00:00:00
Introduction
CVSSv3 Score:
3.8
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in FortiPAM may allow an authenticated attacker with read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands.
Revised on 2025-11-18 00:00...
CVSSv3 Score:
5.2
An insufficiently protected credentials vulnerability [CWE-522] in FortiExtender may allow an authenticated user to obtain administrator credentials via debug log commands.
Revised on 2025-11-18 00:00:00
CISOs have a burgeoning identity crisis on their hands.
According to Verizon’s 2025 Data Breach Investigation Report, cyber attackers have switched up their initial access vectors of choice, with stolen credentials a leading cause of data breaches, triggering 22% of all int...
CVSSv3 Score:
5.0
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in FortiSandbox may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file.
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
4.9
An active debug code vulnerability [CWE-489] in FortiClientWindows may allow a local attacker to run the application step by step and retrieve the saved VPN user password
Revised on 2025-11-18 00:00:00
India’s Digital Personal Data Protection Act (DPDP), 2023, signaled the country’s commitment to building a modern and globally aligned privacy framework. But as with any legislation, the true operational impact becomes clear only when detailed rules are published. With the release of the Digital Per...
CVSSv3 Score:
3.9
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiADC Logs may allow an admin with read-only permission to get the external resources password via the logs of the product.
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
6.7
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.Fortinet h...
SANTA CLARA, Calif., Nov 18, 2025 — International Data Corporation (IDC) officially released the “2025 IDC China Top 10 Cybersecurity Professionals” at the 10th IDC China CIO Summit last month. This honor is intended to recognize outstanding individuals who have made significant contributions to Chi...
CVSSv3 Score:
6.3
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
Revised on 2025-11-18 00:00:00
CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiVoice may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Revised on 202...
Dutch police seized 250 servers running a bulletproof hosting service tied to cybercriminals and linked to over 80 investigations since 2022. Dutch police Politie, seized 250 servers running an unnamed bulletproof hosting service used solely by cybercriminals. Active since 2022, it appeared in over...