■■□□□ Fortinet Warns of New FortiWeb CVE-2025-58034 Vulnerability Exploited in the Wild.

https://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html

■■■■□ Interesting thread: ATM Hacking Group UNC2891 Technical Summary.

https://x.com/blackorbird/status/1991516037968457814

■■■■□ CSA Announces Zigbee 4.0, with New "Suzi" Sub-Gigahertz Long-Range Support
New sub-brand offers improved range and penetration at low power, while the main standard enjoys improved security.

https://www.hackster.io/news/csa-announces-zigbee-4-0-with-new-suzi-sub-gigahertz-long-range-support-3c6f18540c35

■□□□□ Veeam bets on more VMware alternatives, including Red Hat and China’s Sangfor
Plans a universal API to back up all hypervisors, too.

https://www.theregister.com/2025/11/21/veeam_13_hypervisor_support/

■■■■■ Iran: Interesting thread on APT-35 (Charming Kitten's) elaborate cyber-espionage and HUMINT operation.

https://x.com/blackorbird/status/1992075483836744154

■■■■■ CVE-2025-41115: Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation.

https://thehackernews.com/2025/11/grafana-patches-cvss-100-scim-flaw.html

■■■■□ Unkraine | Electronic Warfare: How Spoofing Is Diverting Russian Missiles Into Empty Fields.

Allegedly 21 Kinzhal Hypersonic missiles have been diverted by Ukrainian forces upto 144 meters in one case.

https://www.forbes.com/sites/davidhambling/2025/11/20/how-spoofing-is-diverting-russian-missiles-into-empty-fields/

■■■■□ Brazilian Campaign: Spreading the Malware via WhatsApp.

https://labs.k7computing.com/index.php/brazilian-campaign-spreading-the-malware-via-whatsapp/

■■■■□ Study exposes how a large state-funded "Censorship Network" steers the online debate in Germany, endangering freedom of expression in Europe's largest economy.

■■■□□ ShinyHunters 'does not like Salesforce at all,' claims the crew accessed Gainsight 3 months ago.

https://www.theregister.com/2025/11/21/shinyhunters_salesforce_gainsight_breach/

■■■■□ OSINT on social media accounts of Israelis allowed Palestinian army (Hamas) to get technical knowledge of Merkava 4 tanks of postal including a kill switch.

An interesting thread: https://x.com/grok/status/1992604660516241461

■■■■□ Weaponized file name flaw makes updating glob an urgent job.

https://www.theregister.com/2025/11/23/infosec_news_in_brief/

■■■□□ The Octopus-Packing Multi-Functional High Boy Aims to Beat the Flipper Zero
Built-in Wi-Fi gives the High Boy an edge over the competition, and an open source release has been promised post-crowdfunding.

https://www.hackster.io/news/the-octopus-packing-multi-functional-high-boy-aims-to-beat-the-flipper-zero-1c95c36da7e3

■■□□□ Wireshark Vulnerabilities Let Attackers Crash by Injecting a Malformed Packet.

cybersecuritynews.com/wireshark-vulnerabilities-4-6-1

■■■■■ Shai Hulud is a self-replicating npm worm that executes malicious code via the postinstall script during package installation. It uses the TruffleHog tool to scan the system, steal sensitive information (such as API keys and tokens), and upload it to randomly named repositories on GitHub.

These repositories have a uniform description of “Sha1-Hulud: The Second Coming”, and over 26.8k such repositories have been discovered so far.

Unlike the previous attack, this time it introduces the setup_bun.js script to install the Bun runtime, followed by executing the core malicious file bun_environment.js.

If GitHub or npm authentication fails, the attacker will delete all files in the user's home directory. The attack started at 3:16 AM, with the first wave targeting go-template and 36 AsyncAPI packages, then expanding to PostHog (4:11) and Postman (5:09), with targets increasing from 20 to a maximum of 100.

https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

Shai-Hulud 2.0: Ongoing Supply Chain Attack

https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack