InfoSecBulletin Cybersecurity for mankind
Microsoft has issued its November 2025 Patch Tuesday, fixing 63 vulnerabilities, including a high-priority zero-day flaw that’s currently exploited. This crucial update provides five critical and 64 important fixes, vital for organizations to strengthen their defenses.
The updates span key products like SQL Server, Windows Hyper-V, Visual Studio, Windows Kernel, Windows WLAN Service, and more.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
A critical patch is needed for a zero-day vulnerability in the Windows Kernel: CVE-2025-62215. This Elevation of Privilege (EoP) vulnerability could let an authenticated attacker gain SYSTEM privileges by exploiting a race condition.
There are four other Critical severity flaws along with the zero-day, which pose serious risks of Remote Code Execution (RCE) or high-level Elevation of Privilege (EoP).
A major flaw, CVE-2025-30398, in Nuance PowerScribe 360 poses a serious information disclosure risk. It arises from a lack of authorization in the system, allowing unauthenticated attackers to exploit it through a specific API call, potentially revealing sensitive server information.
Microsoft also included fixes for five vulnerabilities in its Chromium-based Edge browser.
Given the active exploitation of the Windows Kernel zero-day, IT teams must prioritize and deploy these security patches immediately.
