TLDR INFORMATION SECURITY 2025-11-13

SAP FIXED A MAXIMUM SEVERITY FLAW IN SQL ANYWHERE MONITOR

SAP patched 19 vulnerabilities in November, including CVE-2025-42890 (CVSS 10/10), a critical hardcoded credentials flaw in SQL Anywhere Monitor (Non-GUI) that enabled arbitrary code execution with complete system compromise. Additional critical fixes include CVE-2025-42887 (CVSS 9.9) in SAP Solution Manager, which addresses code injection via missing input sanitization, and an update to CVE-2025-42944 that addresses insecure deserialization in SAP NetWeaver AS Java. Organizations should immediately discontinue SQL Anywhere Monitor usage, delete all monitor database instances, and apply patches across affected SAP products. No evidence of active exploitation has been reported.

AMAZON DISCOVERS APT EXPLOITING CISCO AND CITRIX ZERO-DAYS

Amazon's threat intelligence team discovered an APT exploiting zero-day vulnerabilities CVE-2025-20337 in Cisco Identity Service Engine (pre-authentication RCE via deserialization) and CVE-2025-5777 in Citrix systems. The attacks were detected via MadPot honeypots before public disclosure. The threat actor deployed a custom Java web shell named IdentityAuditAction, which features in-memory operation, Java reflection for thread injection, DES encryption with non-standard Base64 encoding, and HTTP header-based authentication requiring specific knowledge to access. Organizations should immediately patch affected Cisco ISE and Citrix NetScaler systems, implement firewall restrictions on management portal access, deploy defense-in-depth strategies for identity infrastructure, and monitor for anomalous behavior patterns in authentication systems even when properly configured.

SYNOLOGY FIXES BEESTATION ZERO-DAYS DEMOED AT PWN2OWN IRELAND

Synology has fixed a critical vulnerability in its BeeStation OS, which powers Synology NAS devices, discovered by researchers at Pwn2Own Ireland. A buffer overflow causes the vulnerability and can result in remote code execution.

NO LEAK, NO PROBLEM - BYPASSING ASLR WITH A ROP CHAIN TO GAIN RCE

A showcase on how to exploit a modern ARM-based IoT device, specifically a network camera, by bypassing Address Space Layout Randomization (ASLR) to achieve unauthenticated remote code execution (RCE) using a Return-Oriented Programming (ROP) chain. This approach cleverly bypasses ASLR, a memory protection mechanism designed to block exploit attempts, allowing remote code execution without requiring the leakage of addresses. By manipulating writable memory and leveraging known offsets, the attacker can execute commands on the device, illustrating how gaps in embedded device security can be exploited even with mitigations in place.

ACTIVE DIRECTORY UNDER SIEGE: WHY CRITICAL INFRASTRUCTURE NEEDS STRONGER SECURITY

Active Directory remains the authentication backbone for 90% of Fortune 1000 companies, with attackers exploiting golden ticket attacks, DCSync privilege escalation, Kerberoasting, and compromised credentials (involved in 88% of breaches per Verizon DBIR) to gain network-wide control, as demonstrated by the 2024 Change Healthcare breach, where MFA absence enabled full AD compromise. Critical vulnerabilities include weak passwords, service accounts with excessive permissions and non-expiring credentials, cached admin credentials in memory, legacy NTLM protocol exploitation, and hybrid environment complexity, creating visibility gaps between on-premises and cloud security teams. Implement layered defenses, including continuous credential monitoring against breach databases (blocking 4B+ compromised passwords), privileged access management with just-in-time elevation, zero-trust conditional access with MFA for all privileged accounts, continuous AD change monitoring for suspicious patterns, and aggressive patching of domain controllers within days of security updates.

TWO SCENARIO THREAT MODELING

Many people feel intimidated by the number of potential scenarios and never perform threat modeling. Instead, many of the insights of a threat modeling exercise can be garnered by considering only a worst case scenario and a likely but impactful scenario. Security teams should devise detailed story-driven scenarios for these exercises and then proceed in either an informal or formal threat modeling exercise.

Learn how Invicti secures vibe-coded risk

TENZAI (PRODUCT LAUNCH)

Tenzai is an AI-driven penetration testing platform that continuously identifies and addresses software vulnerabilities, aiming to automate manual and infrequent pentesting.

MAILGOOSE

Mailgoose is a web application that allows users to check whether their SPF, DMARC, and DKIM configurations are set up correctly.

PRIVATE AI COMPUTE: OUR NEXT STEP IN BUILDING PRIVATE AND HELPFUL AI

Private AI Compute is a Google platform that enhances AI privacy by combining the power of advanced Gemini cloud models with on-device security standards. This approach ensures users' data is kept private while unlocking fast, intelligent features like smarter suggestions. The system uses encrypted, hardware-secured spaces and multi-layered safeguards, allowing advanced AI without compromising personal data privacy.

AUSTRALIA'S SPY BOSS SAYS AUTHORITARIAN NATIONS READY TO COMMIT ‘HIGH-IMPACT SABOTAGE'

Australia's intelligence chief warns that authoritarian states are increasingly willing and able to sabotage critical infrastructure via cyber-attacks. He cites Chinese hacker groups probing Australian networks, and highlights a shift from espionage to disruptive actions that could cripple essential services.

AWS BACKUP NOW SUPPORTS AMAZON EKS

AWS Backup now allows for creating fully managed backups of EKS clusters. It supports scheduled backups, data retention, immutable vaults, and cross-region and cross-account copies for application data and cluster state.

and cost that fits any business. Download the guide by US Signal

MICROSOFT PATCH TUESDAY SECURITY UPDATES FOR NOVEMBER 2025 FIXED AN ACTIVELY EXPLOITED WINDOWS KERNEL BUG

Microsoft's November 2025 Patch Tuesday addressed 63 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel race condition enabling local privilege escalation to SYSTEM, and CVE-2025-62199, a use-after-free RCE in Microsoft Office.

MALICIOUS NPM PACKAGE SNEAKS INTO GITHUB ACTIONS BUILDS

A typosquatted npm package named "@acitons/artifact," with 260K downloads, targeted GitHub Actions CI/CD pipelines through a post-install hook that ran obfuscated shell scripts to steal tokens and impersonate GitHub by publishing malicious artifacts.

@FACEBOOKMAIL.COM INVITES EXPLOITED TO PHISH FACEBOOK BUSINESS USERS

Attackers sent 40,000 phishing emails to 5,000 Facebook Business users by exploiting Meta's invitation feature to send credential-harvesting links from @facebookmail.com, targeting SMBs in various sectors with fake invites that redirected to phishing pages which mimicked Meta branding.