InfoSecBulletin Cybersecurity for mankind
Microsoft’s February 2025 Patch Tuesday includes security updates for 55 vulnerabilities, including four zero-days, two of which are currently being exploited. This Patch Tuesday addresses three critical remote code execution vulnerabilities.
The number of bugs in each vulnerability category is listed below:
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
19 Elevation of Privilege Vulnerabilities
2 Security Feature Bypass Vulnerabilities
22 Remote Code Execution Vulnerabilities
1 Information Disclosure Vulnerabilities
9 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
This excludes a critical elevation of privileges flaw in Microsoft Dynamics 365 Sales and 10 vulnerabilities in Microsoft Edge fixed on February 6.
Two actively exploited zero-day disclosed:
CVE-2025-21391 : Windows Storage Elevation of Privilege Vulnerability
Microsoft has patched a serious security flaw that can let attackers delete files. According to Microsoft’s advisory, an attacker can only delete specific files on a system. This vulnerability does not expose confidential information but can cause data loss, potentially leading to service downtime. No details are available on how this flaw was exploited or who reported it.
CVE-2025-21418:Â Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
This vulnerability lets attackers obtain high-level access in Windows. It’s unclear how the flaw was exploited in attacks, and Microsoft reported that it was disclosed anonymously.
The publicly disclosed zero-days are:
CVE-2025-21194:Â Microsoft Surface Security Feature Bypass Vulnerability
CVE-2025-21377: NTLM Hash Disclosure Spoofing Vulnerability
Recent updates from other companies:
Other vendors who released updates or advisories in February 2025 include:
Adobe released security updates for numerous products, including Adobe Photoshop, Substance3D, Illustrator, and Animate.
​AMD released mitigations and firmware updates to address a vulnerability that can be exploited to load malicious CPU microcode.
Apple released a security update for a zero-day exploited in ‘extremely sophisticated’ attacks.
Cisco released security updates for multiple products, including Cisco IOS, ISE, NX-OS, and Identity Services.
Google fixed an actively exploited zero-day flaw in Android Kernel’s USB Video Class driver.
Ivanti released security updates for Connect Secure, Neurons for MDM, and Cloud Service Application.
Fortinet released security updates for numerous products, including FortiManager, FortiOS, FortiAnalyzer, and FortiSwitchManager.
Netgear fixed two critical vulnerabilities affecting multiple WiFi router models.
SAP releases security updates for multiple products.
SonicWall firewall vuln allows hackers to hijack VPN sessions
