Do Son Amazon uncovered an advanced APT simultaneously exploiting Cisco ISE RCE (CVE-2025-20337) and Citrix Bleed Two (CVE-2025-5777) as zero-days. The attacker deployed a custom in-memory web shell on Cisco ISE.
A new macOS threat uses malicious AppleScript (.scpt) files, disguised as documents/updates, to bypass Gatekeeper and execute stealers like MacSync and Odyssey, exploiting user trust.
Zoho issued an urgent patch for a Critical (CVSS 9.8) Unauthenticated SQL Injection flaw (CVE-2025-8324) in Analytics Plus. The bug risks remote query execution and account takeover. Update to Build 6171.
A High-severity LPE flaw (CVE-2025-60710) in the WindowsAI Recall Policy Configuration scheduled task allows local users to gain SYSTEM privileges via a symlink arbitrary delete attack.
cybernewswire
New York, New York, 13th November 2025, CyberNewsWire
Google Workspace now supports direct, server-to-server data migration from Dropbox via APIs. Enterprise customers can transfer up to 100 accounts per session.
Apple Wallet now supports digital US Passports for TSA identity checks on domestic flights, eliminating the need for a physical passport or Real ID-compliant license.
Windows 11 now supports a new API allowing password managers (like 1Password, Bitwarden) to handle passkey authentication directly, simplifying cross-platform sign-in.
Valve unveiled Steam Frame VR, a standalone headset with Snapdragon 8 Gen 3, SteamOS, and Foveated Streaming, set to launch in early 2026.
Microsoft changed the KMS activation mechanism in Windows 11 (Build 26040+), removing the license transfer that KMS38 exploited, effectively breaking the activation method.
Seagate's new Exos 4U100 JBOD system offers 3.2 PB of high-density storage in a single chassis for AI and edge data centers, featuring HAMR and 30% lower power use.
Google will soon require all sideloaded Android apps to pass verification and code signing to combat fraud. However, the company is developing an "advanced process" for power users to bypass this.
Palo Alto patched a DoS flaw (CVE-2025-4619) in PAN-OS. An unauthenticated attacker can remotely reboot the firewall if URL proxy or decryption policies are enabled.
GitLab patched a High-severity Stored XSS flaw (CVE-2025-11224, CVSS 7.7) in the Kubernetes proxy feature. The bug allows authenticated users to hijack administrator sessions. Update to v18.5.2+.
Dell patched a Critical (CVSS 9.1) flaw (CVE-2025-46608) in Dell Data Lakehouse that allows a high-privileged remote attacker to escalate privileges and gain unauthorized administrative control. Update to v1.6.0.0.
Singapore, Singapore, 13th November 2025, CyberNewsWire
Google launched Private AI Compute, a new platform that combines Gemini's cloud power with hardware-protected security (TIE) to offer advanced on-device AI for Pixel 10 while guaranteeing data privacy.
Elastic patched two Kibana flaws: CVE-2025-59840 XSS via Vega visualizations and CVE-2025-37734 (SSRF) via the Observability AI Assistant. Update to v9.2.1 immediately.
A Critical flaw (CVE-2025-11919) in Wolfram Cloud allows RCE and privilege escalation. Attackers exploit a race condition in the shared /tmp/ directory to inject code into other tenants' JVMs.
ASEC exposed a SteamCleaner malware clone signed with a valid certificate. It installs a Node.js RCE backdoor via InnoSetup, evades sandboxes, and is suspected of running Proxyware for profit.
For every CISO, the goal is simple but increasingly difficult: stop incidents before they disrupt business. Yet,...
A XSS flaw in Open WebUI allows authenticated users to achieve Admin RCE by injecting JavaScript into rich text prompts, then exploiting the Functions feature. Update to v0.6.35.