⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-13223 | Actively Exploited V8 Type Confusion in Google Chrome and Siemens Chromium Components | 8.8 | 5% | KEV | KEV |
CVE-2025-36250+1 related CVE | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary… | 9.8 | <1% | ||
CVE-2025-40549+2 related CVEs | A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute… | 9.1 | 1% | ||
| CVE-2025-40601 | A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which… | 7.5 | 1% | ||
| CVE-2025-58034 | Authenticated OS Command Injection RCE in Fortinet FortiWeb (active exploitation) | 7.2 | 55% | KEV | KEV |
CVE-2025-60674+3 related CVEs | A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module | 6.8 group max | <1% | PoC | |
| CVE-2025-62765 | General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to… | 8.7 | <1% | ||
| CVE-2025-64446 | Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution | 9.8 | 91% | KEVPoC | KEV |
| CVE-2025-9501 | Unauthenticated Command Injection in W3 Total Cache WordPress Plugin | 9.0 | 20% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 14emeliaterracewestroxburyma02132.su | ogle in Cloudflare's list of top 100 domains, specifically, 14emeliaterracewestroxburyma02132[.]su. ️🔥 Trending CVEs Hackers act fast. They can use new b |
| domain | autorise131.tel | fetch an encrypted payload from Google Drive into %APPDATA%\Autorise131[.]Tel," ANY.RUN said . "The payload is decoded in memory and lo |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Nov 24, 2025 Cybersecurity / Hacking News This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.