A week in security (November 17 – November 23)

Last week on Malwarebytes Labs: AI teddy bear for kids responds with sexual content and advice about weapons Fake calendar invites are spreading. Here’s how to remove them and prevent more Budget Samsung phones shipped with unremovable spyware, say researchers What the Flock is happening with...

Exploit for Improper Neutralization in Microsoft

CVE-2025-26633 - Microsoft Management Console .msc EvilTwin...

Exploit for Relative Path Traversal in Fortinet Fortiweb

CVE-2025-64446 Fortinet FortiWeb Path Traversal RCE Exploit A...

ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

This week has been crazy in the world of hacking and online security. From Thailand to London to the US, we've seen arrests, spies at work, and big power moves online. Hackers are getting caught. Spies are getting better at their jobs. Even simple things like browser add-ons and smart home gadget...

Update your browser: Security fix for Chrome zero-day CVE-2025-13223

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-13223 Share November 20th, 2025 Hi everyone! The latest patches to Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-13223. We recommend...

Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability

Google on Monday released security updates for its Chrome browser to address two security flaws, including one that has come under active exploitation in the wild. The vulnerability in question is CVE-2025-13223 CVSS score: 8.8, a type confusion vulnerability in the V8 JavaScript and WebAssembly...

A week in security (November 10 – November 16)

Last week on Malwarebytes Labs: Be careful responding to unexpected job interviews Your passport, now on your iPhone. Helpful or risky? 1 million victims, 17,500 fake sites: Google takes on toll-fee scammers Are you paying more than other people? NY cracks down on surveillance pricing We opened a...

PT-2025-47132

Microsoft's latest security updates patch over 60 vulnerabilities, including a zero-day vulnerability CVE-2025-62215 and a critical flaw CVE-2025-60274 in a core Windows graphic component, exposing systems to potential exploitation and remote code execution. Defenders should prioritize patching...

CVE-2025-43401

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1005/ 2026-04-02 22:20:32+00:00| seen| Telegram/wWHvFepuomphlvUrhwS7vzUP2t5qXRFryLArMmzBGR2vgG4...

CVE-2025-43432

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1011/...

CVE-2025-43445

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1006/...

CVE-2025-43386

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1004/...

CVE-2025-43384

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1009/...

CVE-2025-43457

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1010/...

CVE-2025-43380

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1008/...

CVE-2025-43383

creationtimestamp| type| source ---|---|--- 2025-11-13 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1003/...

EUVD-2025-131910

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Golemiq 0 Day Analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through 4.0.0...

CVE-2025-64293

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through = 4.0.0...

CVE-2025-64293

CVE-2025-64293 affects the WordPress plugin “0 Day Analytics” (WordPress plugin) up to and including version 4.0.0. The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands, enabling attacker-controlled input to alter queries. Consequences cited in the s...

CVE-2025-64293 WordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through = 4.0.0...