What’s the Key News

• Vulnerability details: CVE-2025-43300 has a CVSS score of 8.8 and stems from ImageIO. A maliciously crafted image file processed by the component could trigger memory corruption.
• Real-world exploitation: Apple confirmed that the vulnerability “may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
• Chained attack vector via WhatsApp: Another vulnerability, CVE-2025-55177 (CVSS 5.4), in WhatsApp for iOS and macOS, is reported to have been chained with CVE-2025-43300 in spyware attacks. Fewer than 200 individuals are believed to be targeted.
• Affected versions & backports: While the fix was first delivered in recent OS updates (e.g., iOS 18.6.2, iPadOS 18.6.2, macOS Ventura 13.7.8, Sonoma 14.7.8, Sequoia 15.6.1), Apple has now backported the patch to older OS versions, including iOS 16.7.12, 15.8.5, and corresponding iPadOS versions covering legacy devices like iPhone 6s/7, iPad Air 2, iPod touch (7th gen) etc.
• Other security fixes: The updates also address a broad slate of other vulnerabilities: from authorization problems in IOKit, keystroke monitoring via LaunchServices, to sandbox permissions, WebKit/ Safari issues, and privilege escalation in DiskArbitration.

Background Context

ImageIO is a core Apple component used to interpret and render images. Out-of-bounds write flaws (writing data outside allocated memory buffers) are dangerous because they often lead to unexpected behavior, crashes, or even arbitrary code execution, should an attacker chain them with other weaknesses. Older devices are especially at risk, as they might no longer receive frequent security patches—or may run outdated OS versions.

The chaining of vulnerabilities—e.g. a flaw in WhatsApp plus CVE-2025-43300—is a classic model in sophisticated spyware and targeted attacks. Attackers often exploit a less privileged bug (such as in an app that can be induced to process a malicious file) together with a system vulnerability to escalate access or persist on a device.

Expert Insights

Although Apple did not name specific attackers or expose full technical details on how the exploit works in the field, the company’s acknowledgment that “specific targeted individuals” were impacted suggests state-level or highly capable adversaries. Security researchers commenting on similar past vulnerabilities warn that ImageIO and other media processing libraries are frequent attack surfaces because they routinely parse untrusted content (images, videos) both from the web and via messaging apps.

Furthermore, backporting fixes to older OS versions demonstrates Apple’s recognition that many devices in the field remain vulnerable and need retrospective protection. This is especially important with legacy devices that users might not update often or cannot update to the latest OS due to hardware constraints.

Conclusion

CVE-2025-43300 is a serious vulnerability actively exploited in the wild and chained with other weaknesses in apps like WhatsApp. Apple’s decision to not only patch its newest operating systems but also backport fixes to older versions is a strong move to mitigate the risk across its device ecosystem. Users of all supported Apple devices—from the latest models down to older hardware—should install updates immediately.

The post Apple Backports Patch for CVE-2025-43300 After Real-World Spyware Exploit appeared first on CyberHood Sentinel.

What’s the Flaw?

Tracked as CVE-2025-43200, the vulnerability stemmed from a logic error in how Apple’s Messages app processed maliciously crafted media—specifically photos or videos shared via iCloud Links. This allowed attackers to execute code silently and without requiring any user interaction

Apple addressed the issue on February 10, 2025, rolling out patches across iOS 18.3.1, iPadOS 18.3.1 and 17.7.5, macOS Sequoia 15.3.1, Sonoma 14.7.4, Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1 These updates also remedied a second unnamed, actively exploited vulnerability (CVE‑2025‑24200), though Apple has not yet disclosed details about that flaw

Who Was Targeted?

Apple acknowledged that CVE‑2025‑43200 was used in a precise, sophisticated campaign targeting Italian journalist Ciro Pellegrino and an unnamed high-profile European journalist Forensic analysis by Citizen Lab confirmed that both were infected with Paragon’s Graphite spyware—an advanced tool designed for silent surveillance, capturing messages, emails, microphone and camera data, and location, all without user interaction

One infection occurred in January–early February 2025 on a device running iOS 18.2.1. It was stealthy enough that neither journalist likely noticed anything amiss . Apple informed the individuals of the targeting on April 29, 2025, through its threat notification system aimed at flagging suspected state-sponsored attacks.

What Is Graphite and Who’s Behind It?

Developed by Israel-based offensive cyber contractor Paragon, Graphite is marketed to state-level clients as a mercenary spyware platform . It can stealthily infiltrate Apple devices via zero-click vectors—such as corrupted media files—granting near-total access to device capabilities. It’s typically sold under national-security pretenses.

Evidence suggests both journalists were targeted from the same Apple account, codenamed “ATTACKER1”, indicating a single Paragon customer orchestrated the attack

Broader Graphite Backstory

Graphite has previously gained infamy. Notably, Meta-owned WhatsApp reported that Graphite was deployed against dozens of users globally, including Pellegrino’s colleague, journalist Francesco Cancellato, bringing the public count of known victims to at least seven

Earlier this week, Paragon announced it had ended contracts with the Italian government. The company cited Italy’s refusal to allow independent verification that the spyware wasn’t used against investigative journalists

Meanwhile, Italy’s Copasir (Parliamentary Committee for Republic Security) confirmed that Italian intelligence agencies used Graphite—but not on journalists—claiming it was deployed for law enforcement tasks including fugitive tracking, counter-terrorism, organized crime, smuggling, and counter-espionage .

Graphite’s infrastructure requires operator login credentials; every deployment generates logs. These logs reside on customer-controlled servers, not Paragon’s, introducing minimal external oversight

Risk and Global Implications

The Citizen Lab emphasized that journalists across Europe remain vulnerable to invasive digital surveillance, spotlighting how unchecked spyware proliferates and threatens privacy. The EU has already criticized such spyware use, calling for stringent export controls and stronger legal safeguards. These incidents are likely to intensify policy focus in Brussels and national capitals.

Apple’s threat notification system relies on threat intelligence; receiving an alert does not necessarily confirm infection—but signals suspicious activity.

Spyware Landscape: A Wider Context

While Graphite looms large, other spyware like Predator has also resurfaced. Recorded Future’s Insikt Group reports renewed Predator operations, including expansion into Mozambique and identification of new servers—highlighting persistent global spyware threats .

What You Can Do

• Update your devices: Ensure your Apple products are updated to the latest iOS, macOS, watchOS, or visionOS versions.
• Stay alert: If you receive a threat notification from Apple, treat it seriously—even if your device seems normal.
• Advocate for change: Encourage stronger legal frameworks to regulate commercial spyware and promote transparency in its deployment.

As zero-click spyware becomes more sophisticated, this case highlights the need for vigilance, transparency, and accountability. Users and policymakers must recognize that threats once limited to espionage circles can now penetrate the heart of civil society.

The post Apple’s Invisible Threat: Zero-Click Spyware Attack on Journalists via iMessage appeared first on CyberHood Sentinel.

Zero-Click, Wormable Exploits

Among the 23 vulnerabilities discovered, some—such as CVE-2025-24252 and CVE-2025-24132—can be chained to create a wormable zero-click remote code execution (RCE) exploit. This means an attacker on the same Wi-Fi network could compromise a device without any user interaction and potentially spread malware to other devices on connected networks.

The vulnerabilities enable various attack vectors, including:​

• Zero- or one-click RCE
• Access control list (ACL) and user interaction bypass
• Local arbitrary file read
• Information disclosure
• Adversary-in-the-middle (AitM) attacks
• Denial-of-service (DoS)​

For instance, chaining CVE-2025-24252 and CVE-2025-24206 can achieve a zero-click RCE on macOS devices connected to the same network, provided the AirPlay receiver is set to “Anyone on the same network” or “Everyone.”​

Widespread Impact on Third-Party Devices

While Apple has released patches for its devices—including iOS 18.4, macOS Sequoia 15.4, and others—millions of third-party devices remain vulnerable. These include smart TVs, speakers, and car infotainment systems that rely on the AirPlay SDK. Many of these devices may not receive timely updates, leaving users exposed to potential attacks. ​

Oligo’s Chief Technology Officer, Gal Elbaz, emphasized the risk: “Because AirPlay is supported in such a wide variety of devices, there are a lot that will take years to patch—or they will never be patched.”

Recommendations for Users

To mitigate the risks associated with these vulnerabilities:

• Update all Apple devices to the latest software versions.
• For third-party devices, check with manufacturers for available updates.
• Disable AirPlay when not in use.
• Restrict AirPlay access to “Current user” in settings.​

These steps can help reduce the attack surface and protect against potential exploits stemming from the AirBorne vulnerabilities.

The post Wormable AirPlay Flaws Allow Zero-Click Attacks on Apple and Third-Party Devices appeared first on CyberHood Sentinel.

What is the WebKit Zero-Day Vulnerability?

The CVE-2025-24201 vulnerability is an out-of-bounds write issue that could enable attackers to execute arbitrary code by tricking users into visiting malicious websites. Apple has confirmed that this exploit has been used in targeted attacks before the patch was released.

Apple Devices Affected by This Exploit

The vulnerability impacts a range of Apple devices, including:
iPhones (iOS 18.3.2 and later) – iPhone XS and newer
iPads (iPadOS 18.3.2 and later) – iPad Pro, iPad Air, iPad Mini
MacBooks (macOS Sequoia 15.3.2 and later)
Safari (Safari 18.3.1 update for macOS Ventura & Sonoma)
Apple Vision Pro (visionOS 2.3.2 update)

How to Protect Your Apple Devices?

Update immediately: Go to Settings > Software Update and install the latest version for your device.
Enable automatic updates to receive future patches as soon as they are available.
Be cautious of phishing links and untrusted websites, as attackers use such techniques to exploit browser vulnerabilities.

Why This Update is Critical

This is Apple’s third zero-day vulnerability fix in 2025, following patches for CVE-2025-24085 and CVE-2025-24200. Given that the exploit has been actively used in real-world attacks, users must update their devices immediately to prevent potential data breaches and unauthorized access.

Final Thoughts

As cybersecurity threats evolve, keeping your Apple devices updated is crucial to staying protected. Install the latest WebKit security patch now and ensure your iPhone, Mac, and iPad remain secure against cyberattacks.

For full details, visit Apple’s official security update page.

The post Apple Releases Emergency Security Patch for WebKit Zero-Day Vulnerability (CVE-2025-24201) appeared first on CyberHood Sentinel.

Enhanced Lockdown Mode: Fortified Defense

One of the standout features of iOS 18 is the expansion of Lockdown Mode. This advanced security option is designed for users who are at risk of targeted attacks from mercenary spyware due to their roles or activities. The enhanced Lockdown Mode in iOS 18 includes:

• Safer Wireless Connectivity Defaults: Ensuring secure connections by default.
• Media Handling and Sharing Defaults: Tightening controls over how media files are handled and shared.
• Sandboxing and Network Security Optimizations: Reducing the risk of exploitation through stringent app and network controls​ (Apple)​​ (Apple)​.

Additionally, Lockdown Mode now extends to watchOS, providing a unified protective barrier for users who rely on both their iPhones and Apple Watches. By activating Lockdown Mode on an iPhone, it automatically engages on the paired Apple Watch, offering comprehensive protection across devices​ (Apple)​.

Check In: Safety with Privacy

iOS 18 introduces a feature called Check In, designed to enhance personal safety while maintaining strict privacy controls. This feature allows users to share their journey progress with selected contacts. Key aspects of Check In include:

• Automatic Destination Detection: It automatically detects when users have reached their intended destination and notifies selected contacts.
• Unexpected Delay Alerts: If users do not make progress toward their destination, Check In will prompt them. If they do not respond, it shares their precise location, battery level, cell service status, and last active time with chosen contacts.
• End-to-End Encryption: Ensuring that shared information is only accessible to the selected contacts, not Apple or any third party​ (Apple)​​ (Apple)​.

NameDrop: Secure and Controlled Sharing

NameDrop revolutionizes the way users share contact information. By simply bringing two iPhones close together, users can exchange contact details securely. Key features include:

• Selective Information Sharing: Users can choose which contact details to share and which to keep private.
• Apple Watch Integration: NameDrop also works with Apple Watch, allowing users to share contact information seamlessly from their wrist.
• Encrypted Connections: All shared content, including photos and links, is transmitted over an encrypted connection, ensuring privacy and security​ (Apple)​​ (Apple)​.

Live Voicemail: Enhanced Call Management

iOS 18 introduces Live Voicemail, a feature that transcribes voicemail messages in real-time, allowing users to decide whether to answer or ignore calls. This feature offers several benefits:

• Real-Time Transcription: See a live transcription of voicemail messages as the caller speaks.
• Spam and Scam Protection: Calls identified as spam are automatically filtered out, providing users with peace of mind.
• On-Device Processing: All voicemail transcriptions occur on the device, ensuring that the information is not shared with Apple​ (Apple)​​ (Apple)​.

Safari Private Browsing: Superior Privacy Protection

Safari’s private browsing mode receives significant updates in iOS 18, making it even more secure. Enhancements include:

• Automatic Locking: Private browsing sessions lock automatically when not in use, protecting open tabs from unauthorized access.
• Advanced Anti-Tracking Measures: Enhanced tracking and fingerprinting protections prevent websites from identifying and tracking users.
• Link Tracking Protection: Removes tracking information from shared URLs in Messages, Mail, and Safari Private Browsing, further enhancing user privacy​ (Apple)​​ (Apple)​.

Photos Privacy Permissions: Controlled Access

Sharing photos with apps is now more secure and user-friendly in iOS 18. Key improvements include:

• Embedded Photo Picker: Allows users to share specific photos with apps while keeping the rest of their library private.
• Privacy Reminders: Users receive regular reminders about their privacy choices, ensuring they stay informed about what they are sharing​ (Apple)​​ (Apple)​.

Communication Safety and Sensitive Content Warning

To protect users, especially children, iOS 18 enhances Communication Safety and introduces Sensitive Content Warning:

• Expanded Communication Safety: Now covers video content and integrates across Messages, AirDrop, and FaceTime. All processing occurs on-device to ensure privacy.
• Sensitive Content Warning: Alerts users about explicit content and allows them to blur such content. Like Communication Safety, it processes data on-device to maintain privacy​ (Apple)​.

Password and Passkey Sharing: Simplified Security

Sharing passwords and passkeys has never been easier or more secure. iOS 18 introduces:

• Group Sharing: Users can create groups to share passwords, ensuring everyone has up-to-date access to shared accounts.
• End-to-End Encryption: All shared information is encrypted, maintaining the highest levels of security​ (Apple)​​ (Apple)​.

HomeKit and Matter: Secure Smart Home Integration

Apple’s commitment to privacy extends to smart home devices with HomeKit and Matter integration. Key security features include:

• Encrypted Data Transmission: Ensures that all data transmitted to HomePod and HomeKit-enabled accessories is encrypted.
• Privacy Controls: Users are always aware of which accessories join their home network, maintaining control over their smart home environment​ (Apple)​.

Conclusion: Leading the Way in Privacy and Security

With iOS 18, Apple continues to set the standard for mobile security and privacy. The new features are designed to protect users’ data, enhance their safety, and provide greater control over their digital lives. Whether it’s through advanced Lockdown Mode, secure sharing with NameDrop, or enhanced private browsing in Safari, iOS 18 ensures that users remain in the driver’s seat of their personal information.

By integrating these robust security measures, Apple reaffirms its commitment to privacy as a fundamental human right. As users increasingly rely on their devices for personal and professional tasks, iOS 18’s comprehensive security features offer peace of mind in a digital world.

Stay tuned for the rollout of these features this fall and experience the next level of privacy and security with iOS 18.

For more detailed information on iOS 18’s security features, visit the official Apple Newsroom.

The post iOS 18: Elevating Security and Privacy to New Height appeared first on CyberHood Sentinel.