■□□□□ IoT: Dashboards for Home Assistant.

https://github.com/Madelena/hass-config-public/?tab=readme-ov-file

■■■□□ Israeli disinformation campaign / insights.

■■■■□ Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs.

New research from CrowdStrike has revealed that DeepSeek's artificial intelligence (AI) reasoning model DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China.

https://thehackernews.com/2025/11/chinese-ai-model-deepseek-r1-generates.html

■■■■□ New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions.

https://thehackernews.com/2025/11/new-fluent-bit-flaws-expose-cloud-to.html

■□□□□ UAE: Public falls for ‘Free WiFi’ QR trap in Sharjah cybersecurity experiment.

https://gulfnews.com/uae/public-falls-for-free-wifi-qr-trap-in-sharjah-cybersecurity-experiment-1.500359662

The QR redirected to:
https://scanned.page/p/xD86lz

■■■■□ Cryptology firm cancels elections after losing encryption key.

https://www.bbc.co.uk/news/articles/c62vl05rz0ko

■■■□□ What happens when you give Burp AI the bare minimum details and just let it hack by itself? Let's find out with 0xTib3rius.

https://youtu.be/1-NkCSW-IUU

■■■■■ Tor switches to new Counter Galois Onion relay encryption algorithm.

https://www.bleepingcomputer.com/news/security/tor-switches-to-new-counter-galois-onion-relay-encryption-algorithm/

■■■■■ Botnet takes advantage of AWS outage to smack 28 countries.

https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/

https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/

■■■■□ SectorA01 (Lazarus) employed a highly sophisticated, multi-stage attack chain

beginning with social engineering via a fake official Deriv trading platform installer (NSIS-based).
The infection progresses through a polyglot payload sequence (NSIS → Electron/JavaScript → Python → .NET), using dynamic code execution via eval() on remotely fetched JavaScript, Pastebin as a dead-drop mechanism with 1,000 pre-generated XOR-encrypted URLs, and Living-off-the-Land techniques by downloading and installing the legitimate official Python interpreter when absent.

Once inside, the malware conducts broad data theft including browser credentials and credit-card information, keylogging with clipboard monitoring and exfiltration, and keyword-based recursive searches for sensitive files (wallet, mnemonic, .env, etc.).
It establishes strong remote access through an AnyDesk backdoor using a pre-configured fixed password via service.conf overwrite, while achieving multi-layered persistence through the startup folder, scheduled tasks, and AnyDesk auto-start.

Defense evasion is comprehensive: it disables Windows Defender and Firewall while adding exclusions, masquerades as the legitimate system process Runtime Broker.exe, tampers PE timestamps to future dates (2070 and 2093), communicates in the final stage exclusively over Tor via a .onion C2 domain, and incorporates automatic client updates with trace self-deletion to hinder detection and analysis.

https://medium.com/@nshcthreatrecon/a-tsunami-sweeping-the-cyber-battlefield-analysis-of-sectora01s-hacking-activities-e4d006baae2f

https://x.com/blackorbird/status/1994001509944840678

■■■■□ Alleged Cloudflare DoS bypass.

https://t.me/DIeNlt/683

■■■□□ Alleged Disclosure of the identity of a 16-year-old teenager; the technical brain of the SLSH ransomware group from Amman, Jordan 🇯🇴

https://t.me/HackerNewscyber/2666

■■■■□ Hackers posing as Kyrgyzstan’s Justice Ministry are spreading 2013-era NetSupport RAT across Kyrgyzstan and Uzbekistan using fake PDFs and old Java tricks—blocking outsiders to hide the attack.

■□□□□ CVE-2025-5318
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

https://access.redhat.com/errata/RHSA-2025:18231

■□□□□ Major Cyber Attacks in November 2025.

https://any.run/cybersecurity-blog/major-cyber-attacks-november-2025/