Researchers say Slack and Microsoft Teams have fundamental issues vetting third-party apps and should overhaul their app model to be more like traditional OSes (Andy Greenberg/Wired)

Lawrence Abrams / BleepingComputer:
Microsoft releases 68 security fixes, including patches for six actively exploited Windows zero-day flaws and 11 vulnerabilities classified as Critical  —  Today is Microsoft’s November 2022 Patch Tuesday, and with it comes fixes for six actively exploited Windows vulnerabilities and a total of 68 flaws.

Andy Greenberg / Wired:
A look at Ukraine’s efforts to block crypto donations to Russia’s military and paramilitary groups, who researchers say have received $4M+ since the invasion  —  Blockchain investigators have uncovered at least $4 million—and counting—in cryptocurrency donations to Russia’s violent militia groups.

Sergiu Gatlan / BleepingComputer:
Fortinet confirms a critical remote authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager is being exploited; a patch is available  —  Fortinet has confirmed today that a critical authentication bypass security vulnerability patched last week is being exploited in the wild.

Andy Greenberg / Wired:
VMware and Google’s Mandiant say a sophisticated hacker group has been installing backdoors in VMware’s virtualization software on multiple targets’ networks  —  For decades, security researchers warned about techniques for hijacking virtualization software.  Now one group has put them into practice.

Andy Greenberg / Wired:
Forensic analysis: hackers planted files on at least three Indian activists and likely colluded with police, yet 11 of 16 activists in related case still jailed  —  And new evidence suggests those hackers may have collaborated with the police who investigated him.

Sergiu Gatlan / BleepingComputer:
Microsoft confirms two zero-day vulnerabilities in Exchange Server 2013, 2016, and 2019 are being exploited; one researcher suspects a Chinese threat actor  —  Microsoft has confirmed that two recently reported zero-day vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019 are being exploited in the wild.