Security Digest: November 17, 2025 - 2 Critical Vulnerabilities

Today, two high-severity vulnerabilities demand your immediate attention. First, a command injection flaw in the glob CLI (CVE-2025-64756) could allow arbitrary code execution through malicious filenames.

· 3 min read

Today's Critical Security Threats: Immediate Action Required

Executive Summary

Today, two high-severity vulnerabilities demand your immediate attention. First, a command injection flaw in the glob CLI (CVE-2025-64756) could allow arbitrary code execution through malicious filenames. Second, an SQL injection vulnerability in phpMyFAQ (CVE-2025-62519) permits database compromise. Both require urgent patching to prevent exploitation.

Critical Vulnerabilities

  • CVE-2025-64756: Command Injection in glob CLI
    • Impact: Enables arbitrary command execution with user privileges.
    • Affected Systems: glob CLI versions v10.3.7 through v11.0.3.
    • Immediate Action: Upgrade to glob@11.1.0 or higher immediately.
    • Mitigation: Use the --cmd-arg option for commands; restrict shell access if upgrade isn't possible.
  • CVE-2025-62519: SQL Injection in phpMyFAQ Configuration
    • Impact: Allows execution of arbitrary SQL queries, potential for full database compromise.
    • Affected Systems: phpMyFAQ versions v4.0.13 and earlier.
    • Immediate Action: Apply the latest security patch from phpMyFAQ.
    • Mitigation: Temporarily restrict 'Configuration Edit' permissions to trusted users only.

What to Do Now

  1. Upgrade the glob CLI to version 11.1.0 or later immediately. Verify by running glob --version.
  2. Apply phpMyFAQ's latest patch and restrict configuration editing permissions. Confirm patch by checking phpMyFAQ version.
  3. Monitor logs for unusual file operations or SQL queries.

Related Resources

  • Check our internal blog for detailed write-ups on these vulnerabilities.
  • Refer to the official npm advisory for glob CLI and phpMyFAQ's security announcements.

Keep reading