TLDR INFORMATION SECURITY 2025-11-20

has had on security and efficiency.

Watch now

RONDODOX BOTNET MALWARE NOW HACKS SERVERS USING XWIKI FLAW

The RondoDox botnet is exploiting a flaw in the XWiki SolrSearch endpoint, using crafted HTTP GET requests to inject base64-encoded Groovy payloads that download and execute malware. The campaign appears to reuse previously identified infrastructure, meaning existing IOC blocklists should effectively mitigate the threat.

WHATSAPP SECURITY FLAW EXPOSES 3.5B USERS' DATA FROM ‘BASIC PUBLICLY AVAILABLE INFORMATION'

Austrian researchers discovered that all 3.5B WhatsApp users can be enumerated at a rate of 100M users per hour. The researchers used the WhatsApp Web interface to bulk add users and phone numbers and were able to extract phone numbers for all users, profile photos for 57% of users, and profile text for 27%. Meta implemented rate limiting to address this issue, but also stated that the data exposed was basic publicly available information.

W3 TOTAL CACHE WORDPRESS PLUGIN VULNERABLE TO PHP COMMAND INJECTION

WordPress security company WPScan discovered a vulnerability in the W3 Total Cache plugin that enables unauthenticated attackers to execute code by posting a comment with a malicious payload. A patch is available. WPScan is withholding proof-of-concept details until November 24 to give site owners time to update.

NEXT.JS SECURITY TESTING GUIDE FOR BUG HUNTERS AND PENTESTERS

Deepstrike released a detailed security guide covering common pitfalls in Next.js applications, noting that while the framework includes strong default protections against template injection and XSS, developers can introduce risk through unsafe patterns like dangerouslySetInnerHtml or third-party templating engines. The guide highlights additional attack surfaces, including SSRF via the image optimization pipeline or misconfigured server actions.

SHADOWRAY 2.0: ACTIVE GLOBAL CAMPAIGN HIJACKS RAY AI INFRASTRUCTURE INTO SELF-PROPAGATING BOTNET

ShadowRay 2.0 is a malware campaign targeting Ray, a popular open-source AI framework, to hijack powerful computing clusters and convert them into a global, self-propagating botnet. Attackers exploited legitimate orchestration features within Ray, enabling them to orchestrate compute jobs, steal data, launch DDoS attacks, and autonomously spread across organizations. Attackers quickly weaponized unpatched flaws and misconfigurations in Ray clusters that were mistakenly exposed to the internet.

SUPAPWN: HACKING OUR WAY INTO LOVABLE'S OFFICE AND HELPING SECURE SUPABASE

SupaPwn is a multi-stage exploit chain affecting outdated Supabase environments, where weaknesses in privilege controls, host configurations, and cloud credential handling allowed attackers to escalate far beyond expected tenant-level permissions, even reaching infrastructure belonging to other customers. AI tooling accelerated reconnaissance and exploit development, helping researchers validate the chain quickly. Supabase and Lovable patched all affected systems within a day, limiting impact to a small set of outdated deployments.

Management report_

DETONATORAGENT

DetonatorAgent is a cross-platform Web API for detonating malware on VMs and collecting EDR logs.

AI-POWERED CAPTCHA SOLVER

AI-Powered CAPTCHA Solver is a Python CLI tool that uses LLMs to automatically solve various types of CAPTCHAs using an embedded Selenium browser.

MATE (PRODUCT LAUNCH)

Mate uses AI agents and reasoning models to automate security incident investigation and response in SOCs, reducing false positives and MTTR and enabling the SOC to learn and improve continuously.

CLOUDFLARE OUTAGE ON NOVEMBER 18, 2025

Cloudflare has released its postmortem on the November 18 outage. The incident was traced to a database permissions change that caused oversized Bot Management feature files to be generated. Those files triggered repeated module crashes and widespread 5xx errors. The team initially suspected a DDoS attack, which delayed diagnosis and remediation.

SERVICENOW AI AGENTS CAN BE TRICKED INTO ACTING AGAINST EACH OTHER VIA SECOND-ORDER PROMPTS

ServiceNow's Now Assist AI agents can be manipulated through second-order prompt injection, where instructions passed between agents trigger unintended actions. Attackers can use this to escalate privileges, steal data, or redirect workflows. ServiceNow claims the behavior matches expected agent chaining, but organizations are urged to monitor agent interactions and harden guardrails.

TENS OF THOUSANDS MORE ASUS ROUTERS PWNED BY SUSPECTED, EVOLVING CHINA OPERATION

A major cyber campaign dubbed "Operation WrtHug" has compromised around 50,000 outdated ASUS routers across Taiwan and Southeast Asia by chaining six known vulnerabilities. The activity resembles prior Chinese-linked campaigns. Researchers suspect the operation could support espionage, distinguishing it from traditional botnets by its stealthy data theft behavior.

Book a demo

THUNDERBIRD ADDS NATIVE SUPPORT FOR MICROSOFT EXCHANGE ACCOUNTS

Thunderbird 145 now includes native Exchange Web Services (EWS) support, allowing users to add Microsoft Exchange accounts without relying on third-party extensions.

MICROSOFT TO INTEGRATE SYSMON DIRECTLY INTO WINDOWS 11, SERVER 2025

Microsoft announced that it will integrate the popular Sysmon tool directly into Windows 11 and Server 2025 next year.

FIVE EYES JUST MADE LIFE HARDER FOR BULLETPROOF HOSTING PROVIDERS

The US, UK, and Australia jointly sanctioned Media Land, a Russia-based bulletproof hosting provider accused of supporting major ransomware groups, including LockBit, BlackSuit, and Play.