Tag: zero-day
-
CISA Warns of Actively Exploited 0-Day Vulnerability in Apple iOS, iPadOS, and macOS
Tags: apple, cisa, cve, cyber, cybersecurity, exploit, framework, infrastructure, macOS, risk, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical zero-day vulnerability affecting Apple iOS, iPadOS, and macOS systems that is being actively exploited in the wild. CVE-2025-43300, an out-of-bounds write vulnerability in Apple’s Image I/O framework, poses significant security risks to millions of users across Apple’s ecosystem. Critical Vulnerability…
-
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Cybersecurity researchers are calling attention to malicious activity orchestrated by a China-nexus cyber espionage group known as Murky Panda that involves abusing trusted relationships in the cloud to breach enterprise networks.”The adversary has also shown considerable ability to quickly weaponize N-day and zero-day vulnerabilities and frequently achieves initial access to their targets by First seen…
-
Integrated SIEMEDR Platform
Tags: attack, business, cybersecurity, detection, edr, firewall, infrastructure, phishing, ransomware, siem, soar, tool, zero-dayThe cybersecurity landscape has reached a tipping point. Organizations are battling a constant barrage of advanced threats”, ransomware, phishing, insider attacks, and zero-day exploits”, that can cripple critical infrastructure and disrupt business continuity. Traditional point solutions like firewalls, intrusion detection systems, or standalone EDR tools, while useful, often operate in silos. This leaves security teams…
-
After SharePoint attacks, Microsoft stops sharing PoC exploit code with China
Microsoft halts PoC exploit sharing with Chinese firms after SharePoint zero-day leaks, giving only written bug details to curb future abuse. Microsoft has reportedly stopped giving Chinese firms proof-of-concept exploit code through its Microsoft Active Protections Program (MAPP) program after July’s mass exploitation of SharePoint flaws, believed linked to a leak of early bug disclosures.…
-
Apple Releases Patch for Likely Exploited Zero-Day Vulnerability
All Apple users are encouraged to update their iPhones, iPads and macOS devices First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/apple-patch-likely-exploited-zero/
-
U.S. CISA adds Apple iOS, iPadOS, and macOS flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple iOS, iPadOS, and macOS flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple iOS, iPadOS, and macOS flaw, tracked as CVE-2025-43300, to its Known Exploited Vulnerabilities (KEV) catalog. This week, Apple addressed the actively exploited zero-day CVE-2025-43300 in iOS, iPadOS, and…
-
Apple discloses actively exploited zero-day affecting iOS, iPadOS and macOS
The defect, which affects the company’s most popular devices, has been exploited in an “extremely sophisticated attack against specific targeted individuals,” Apple said. First seen on cyberscoop.com Jump to article: cyberscoop.com/apple-zero-day-ios-macos-ipados-august-2025/
-
Nuance Agrees to Pay $8.5M to Settle MOVEit Hack Litigation
Tags: communications, data, exploit, flaw, hacker, healthcare, microsoft, moveIT, software, zero-daySettlement Is Latest Among Scores of Other MOVEit Lawsuits Still Pending. Nuance Communications, a Microsoft subsidiary, has agreed to pay $8.5 million to settle class action litigation filed after hackers exploited a zero-day flaw in Progress Software’s MOVEit file transfer software in 2023, stealing data belonging to more than a dozen of Nuance’s healthcare clients.…
-
Apple iOS update fixes new iPhone zero-day flaw
Latest Apple zero-day found in the ImageIO framework opens the door for targeted zero-click attacks on iPhone users. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366629973/Apple-iOS-update-fixes-new-iPhone-zero-day-flaw
-
Apple addressed the seventh actively exploited zero-day
Apple addressed a vulnerability impacting iOS, iPadOS, and macOS that it is under active exploitation in the wild. Apple addressed an actively exploited zero-day, tracked as CVE-2025-43300, in iOS, iPadOS, and macOS. The vulnerability is zero-day out-of-bounds write issue that resides in the ImageIO framework, an attacker could exploit it to cause memory corruption when processing…
-
Paper Werewolf Exploits WinRAR Zero-Day Vulnerability to Deliver Malware
Cyber spies associated with the threat actor group Paper Werewolf have demonstrated advanced capabilities in bypassing email security filters by delivering malware through seemingly legitimate archive files, a tactic that exploits the commonality of such attachments in business correspondence. Despite their sophistication, these attackers continue to rely on detectable tactics, techniques, and procedures (TTPs), underscoring…
-
Apple rushes out fix for active zero-day in iOS and macOS
Another ‘extremely sophisticated’ exploit chewing at Cupertino’s walled garden First seen on theregister.com Jump to article: www.theregister.com/2025/08/21/apple_imageio_exploit/
-
20 Jahre Zero Day Initiative – Happy Birthday, Zero Day Initiative
Tags: zero-dayFirst seen on security-insider.de Jump to article: www.security-insider.de/20-jahre-zero-day-initiative-kampf-gegen-cyberangriffe-a-8d6726433c755c35d6a63deac0469461/
-
CVE-2025-43300: Critical Zero-Day Bug in iOS, iPadOS, and macOS
CVE-2025-43300: Vulnerability in Image Handling Framework Apple has released urgent software updates for iPhones, iPads, and Macs after identifying a zero-day security flaw that was already being exploited. The issue, cataloged as CVE-2025-43300, exists in the ImageIO framework and can… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2025-43300-zero-day-apple/
-
Apple Confirms Critical 0-Day Under Active Attack Immediate Update Urged
Apple has issued an emergency security update for iOS 18.6.2 and iPadOS 18.6.2 to address a critical zero-day vulnerability that the company confirms is being actively exploited in sophisticated attacks against targeted individuals. The update, released on August 20, 2025, patches a severe flaw in the ImageIO component that could allow attackers to execute malicious…
-
Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks
Apple has released security updates to address a security flaw impacting iOS, iPadOS, and macOS that it said has come under active exploitation in the wild.The zero-day out-of-bounds write vulnerability, tracked as CVE-2025-43300, resides in the ImageIO framework that could result in memory corruption when processing a malicious image.”Apple is aware of a report that…
-
WinRAR Zero-Day Exploited by Russian-Linked Hackers RomCom and Paper Werewolf
Older WinRAR versions let malicious archives override the user-specified path via crafted archives, enabling stealthy system compromise. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-winrar-zero-day-hackers-romcom-paper-werewolf/
-
Apple fixes zero-day vulnerability exploited in >>extremely sophisticated attack<< (CVE-2025-43300)
Apple has fixed yet another vulnerability (CVE-2025-43300) that has apparently been exploited as a zero-day >>in an extremely sophisticated attack against specific … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/20/apple-zero-day-vulnerability-exploited-in-extremely-sophisticated-attack-cve-2025-43300/
-
Apple fixes new zero-day flaw exploited in targeted attacks
Apple has released emergency updates to patch another zero-day vulnerability that was exploited in an “extremely sophisticated attack.” First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-new-actively-exploited-zero-day/
-
Futurum Signal is Live: Real-Time Intelligence for Cyber Defenders
Tags: ai, attack, cyber, cybersecurity, intelligence, phishing, ransomware, tactics, threat, update, zero-dayIn cybersecurity, timing is everything. Threats don’t wait for quarterly analyst updates, and adversaries don’t schedule their attacks to match publication calendars. We live in a world where zero-days drop overnight, AI-powered phishing campaigns spin up in hours, and ransomware operators pivot their tactics daily. In this kind of environment, static analyst reports are less..…
-
New zero-day startup offers $20 million for tools that can hack any smartphone
Prices for hacking tools that allow governments to break into mobile phones keep going up, thanks to efforts by tech firms shoring up their cybersecurity. First seen on techcrunch.com Jump to article: techcrunch.com/2025/08/20/new-zero-day-startup-offers-20-million-for-tools-that-can-hack-any-smartphone/
-
At least three UK organizations hit by SharePoint zero-day hacking campaign
At least three British organizations have reported to the country’s data protection regulator that hackers exploited bugs affecting on-premise Microsoft SharePoint servers. First seen on therecord.media Jump to article: therecord.media/organizations-united-kingdom-sharepoint
-
PipeMagic Backdoor Resurfaces as Part of Play Ransomware Attack Chain
Attackers are wielding the sophisticated modular malware while exploiting CVE-2025-29824, a previously zero-day flaw in Windows Common Log File System (CLFS) that allows attackers to gain system-level privileges on compromised systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/pipemagic-backdoor-resurfaces-play-ransomware-attack-chain
-
Elastic rejects claims of a zero-day RCE flaw in Defend EDR
Enterprise search and security company Elastic is rejecting reports of a zero-day vulnerability impacting its Defend endpoint detection and response (EDR) product. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/elastic-rejects-claims-of-a-zero-day-rce-flaw-in-defend-edr/
-
SAP 0-Day Exploit Reportedly Leaked by ShinyHunters Hackers
A sophisticated exploit targeting critical SAP vulnerabilities has been publicly released by the notorious hacking group ShinyHunters, significantly escalating the threat landscape for enterprise SAP environments. The exploit, which chains together multiple zero-day vulnerabilities, was allegedly leaked through the >>Scattered LAPSUS$ Hunters ShinyHunters
-
Cooking with Code: A DevOps Kitchen Secured by Thales
Tags: access, ai, api, cctv, cloud, compliance, control, data, encryption, GDPR, identity, infrastructure, injection, least-privilege, malicious, mfa, military, monitoring, PCI, service, software, strategy, tool, waf, zero-day, zero-trustCooking with Code: A DevOps Kitchen Secured by Thales madhav Tue, 08/19/2025 – 05:13 In today’s hyperconnected digital world, deploying applications is a lot like running a high-performance, Michelin-star kitchen. You need the right setup, a disciplined process, and seamless coordination, where every tool, role, and task moves in harmony, executed flawlessly. Speed and precision…
-
Threat Actors Exploit Microsoft Help Index File to Deploy PipeMagic Malware
Cybersecurity researchers have uncovered a sophisticated campaign where threat actors leverage a Microsoft Help Index File (.mshi) to deploy the PipeMagic backdoor, marking a notable evolution in malware delivery methods. This development ties into the exploitation of CVE-2025-29824, a zero-day elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver, which Microsoft…
-
Technical Details of SAP 0-Day Exploitation Script for RCE Revealed
Tags: cve, cyber, cybersecurity, endpoint, exploit, flaw, rce, remote-code-execution, sap, vulnerability, zero-dayCybersecurity researchers have unveiled the inner workings of an exploit script targeting a critical zero-day vulnerability in SAP NetWeaver’s Visual Composer Metadata Uploader, now designated as CVE-202531324. This flaw stems from a missing authorization check on the HTTP endpoint /developmentserver/metadatauploader, enabling unauthenticated file uploads that can lead to remote code execution (RCE) under the SAP…
-
Technical Details of SAP 0-Day Exploitation Script for RCE Revealed
Tags: cve, cyber, cybersecurity, endpoint, exploit, flaw, rce, remote-code-execution, sap, vulnerability, zero-dayCybersecurity researchers have unveiled the inner workings of an exploit script targeting a critical zero-day vulnerability in SAP NetWeaver’s Visual Composer Metadata Uploader, now designated as CVE-202531324. This flaw stems from a missing authorization check on the HTTP endpoint /developmentserver/metadatauploader, enabling unauthenticated file uploads that can lead to remote code execution (RCE) under the SAP…
-
Dutch NCSC: Citrix NetScaler zero-day breaches critical orgs
Dutch NCSC warns CVE-2025-6543 Citrix bug, a memory overflow flaw, is being exploited to breach critical organizations in the Netherlands. The Dutch NCSC warns that the critical Citrix NetScaler flaw CVE-2025-6543 has been exploited to breach critical organizations in the Netherlands. Dutch NCSC experts pointed out that CVE-2025-6543 was exploited for remote code execution. Threat…