InfoSecBulletin Cybersecurity for mankind
CISA has instructed U.S. gov.t agencies to secure their systems within a week due to a vulnerability in Fortinet’s FortiWeb web application firewall that has been exploited in zero-day attacks.
CVE-2025-58034 is an OS command injection flaw that lets authenticated attackers execute code with minimal effort and no user interaction.
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
“An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands,” Fortinet said on Tuesday.
The cybersecurity agency included the vulnerability in its Known Exploited Vulnerabilities Catalog and has given FCEB agencies until November 25th to secure their systems as required by Binding Operational Directive 22-01.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA warned.
“With recent and ongoing exploitation events [..], a reduced remediation timeframe of one week is recommended,” it added, referring to a second FortiWeb flaw (CVE-2025-64446) exploited in zero-day attacks that Fortinet silently patched in late October.
On Friday, CISA added vulnerability CVE-2025-64446 to its list of actively exploited security flaws, instructing U.S. federal agencies to patch their devices by November 21st.
