---
title: "Security digest: November 24, 2025"
url: https://erroneo.us/security/2025-11-24/
description: "November 24, 2025 vulnerability digest: 1 brief (Shai-Hulud 2.0 (Sha1-Hulud: The Second Coming)); 1 critical advisory (Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-11-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 24, 2025

1 editorial brief and 1 critical advisory.

## Take stock

- Check exposure: Shai-Hulud 2.0 (Sha1-Hulud: The Second Coming) . Teams whose lockfiles, CI logs or artifact caches show a flagged version installed in late November 2025, and anyone who finds a 'Sha1-Hulud' repo or SHA1HULUD runner under their GitHub account.
- Go: 1 critical advisory ( github.com/lf-edge/ekuiper/v2 ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Shai-Hulud 2.0: npm Worm Hits PostHog, Zapier, Postman](https://erroneo.us/security/briefs/shai-hulud-2-npm-worm/index.md): The worm is long dead on npm, but any machine or CI runner that installed a trojanized version between Nov 21 and Nov 27, 2025 should be treated as having leaked every secret it could reach.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-rj4j-2jph-gg43](https://erroneo.us/security/ghsa/GHSA-rj4j-2jph-gg43/index.md) LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction — Go github.com/lf-edge/ekuiper/v2 < 2.3.0 → 2.3.0

---
Source page: https://erroneo.us/security/2025-11-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt