Cybersecurity News | Daily Recap [19 Nov 2025]

Daily Recap, Cloudflare faced a global outage due to an internal database permissions/configuration error, not a cyberattack, while Fortinet’s FortiWeb flaws prompted a 7-day patch window per CISA. The recap highlights multiple evolving threat vectors, including AI-assisted intrusions (Tuoni), phishing and MFA bypass, ransomware supply chain activity (ShinySp1d3r, PlushDaemon), and state-sponsored and politically sensitive cyber operations.
#Cloudflare #FortiWeb #Tuoni #Sneaky 2FA #DoorDash Incident #ShinySp1d3r #PlushDaemon #LG Ransomware #W3 Total Cache #WrtHug #ShadowRay #Pajemploi Breach #CCTV Hack #Airline Broker #Meta Bounties #Denmark DDoS #National Cyber Strategy

Cloudflare suffered a global service disruption traced to an internal database permissions/configuration error — analysis shows it was not a cyberattack – Cloudflare Outage, Cloudflare Analysis, Cloudflare Not Attack, Cloudflare Hit

FortiWeb vulnerabilities and a controversial silent patch have been linked to active exploitation, prompting CISA to tell agencies to apply fixes within 7 days – CISA 7 Days, FortiWeb CVE, FortiWeb Zero-Day, Silent Patch Concern

The AI-augmented Tuoni C2 framework was used in an attempted intrusion against a major US real-estate firm, blending social engineering, steganography, and AI-driven code delivery – Tuoni Framework, Tuoni Research

MI5 warns UK lawmakers that suspected Chinese intelligence operatives are using LinkedIn to target Parliament members for recruitment and espionage – MI5 Alert, MI5 Warns, MI5 LinkedIn
Activity from state-linked APTs continues: Iran-linked UNC1549 targets aerospace via DLL hijacks and VDI breakouts, while a suspected Russian affiliate of Void Blizzard was arrested in Thailand – UNC1549, Void Blizzard Arrest

The new RaaS ShinySp1d3r from the ShinyHunters group and a wave of supply-chain attacks where PlushDaemon hijacked software updates highlight expanding ransomware and update-tampering threats – ShinySp1d3r, PlushDaemon
An overseas facility of an LG battery subsidiary was hit by a ransomware attack targeting operations — company confirms incident – LG Ransomware

New phishing toolkits like Sneaky 2FA and the Tycoon platform increasingly bypass legacy MFA by mimicking browser UI elements and adding BitB pop-ups to harvest codes – Sneaky 2FA, Tycoon 2FA
Major vendor incident: DoorDash confirmed a cybersecurity incident following a social-engineering attack on employees – DoorDash Incident

Microsoft announced security enhancements across identity, defense, and compliance, plus plans to integrate Sysmon into Windows 11/Server 2025 to boost telemetry – Microsoft Enhancements, Sysmon Integration
Microsoft also rolled out Windows 11 Cloud Rebuild and Point-in-Time Restore tools, and Teams will let users report messages wrongly flagged as threats – Windows 11 Tools, Teams Reporting
Client and mail updates: Thunderbird added native support for Microsoft Exchange accounts – Thunderbird Exchange

Researchers warn about hidden risks in DevOps stack data and cloud workloads, offering mitigation strategies for access control and compliance in production pipelines – DevOps Risks, Cloud Workloads Webinar

A critical W3 Total Cache flaw (CVE-2025-9501) endangers over 1,000,000 WordPress sites if unpatched — update or mitigate now – W3 Total Cache

The new WrtHug campaign has hijacked thousands of end-of-life ASUS routers to build botnets and persistence, underscoring risks from unsupported IoT gear – WrtHug Campaign
ShadowRay attacks are converting Ray compute clusters into covert crypto miners, exploiting misconfigured or exposed cluster controls – ShadowRay Miners

French childcare agency Pajemploi reported a breach exposing data of 1.2M people (no financial data affected) raising identity-theft concerns – Pajemploi Breach
An attack exposed intimate footage from roughly 50,000 CCTVs in India, with sensitive hospital videos offered for sale online – CCTV Hack
An airline data broker has agreed to stop selling individuals’ travel records to government agencies amid privacy scrutiny – Airline Broker

A California man pleaded guilty to laundering over $25M of funds tied to a $230M cryptocurrency heist that used social engineering, hacking, and layered blockchain laundering techniques – Crypto Laundering

Meta paid out $4M via its bug bounty program in 2025 and expanded WhatsApp security research with a new proxy tool to strengthen app protections – Meta Bounties, WhatsApp Research

A pro-Russian group claimed DDoS hits on Danish party websites as voters headed to the polls, disrupting political services – Denmark DDoS

The White House says the upcoming national cyber strategy will include efforts to shape adversary behavior alongside defensive measures – National Cyber Strategy
The CBO director testified that hackers had been expelled from sensitive email systems after government-led remediation efforts — a sign of active incident response in federal networks – CBO Testimony

SHARE THIS STORY