What’s the Flaw?

Tracked as CVE-2025-43200, the vulnerability stemmed from a logic error in how Apple’s Messages app processed maliciously crafted media—specifically photos or videos shared via iCloud Links. This allowed attackers to execute code silently and without requiring any user interaction

Apple addressed the issue on February 10, 2025, rolling out patches across iOS 18.3.1, iPadOS 18.3.1 and 17.7.5, macOS Sequoia 15.3.1, Sonoma 14.7.4, Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1 These updates also remedied a second unnamed, actively exploited vulnerability (CVE‑2025‑24200), though Apple has not yet disclosed details about that flaw

Who Was Targeted?

Apple acknowledged that CVE‑2025‑43200 was used in a precise, sophisticated campaign targeting Italian journalist Ciro Pellegrino and an unnamed high-profile European journalist Forensic analysis by Citizen Lab confirmed that both were infected with Paragon’s Graphite spyware—an advanced tool designed for silent surveillance, capturing messages, emails, microphone and camera data, and location, all without user interaction

One infection occurred in January–early February 2025 on a device running iOS 18.2.1. It was stealthy enough that neither journalist likely noticed anything amiss . Apple informed the individuals of the targeting on April 29, 2025, through its threat notification system aimed at flagging suspected state-sponsored attacks.

What Is Graphite and Who’s Behind It?

Developed by Israel-based offensive cyber contractor Paragon, Graphite is marketed to state-level clients as a mercenary spyware platform . It can stealthily infiltrate Apple devices via zero-click vectors—such as corrupted media files—granting near-total access to device capabilities. It’s typically sold under national-security pretenses.

Evidence suggests both journalists were targeted from the same Apple account, codenamed “ATTACKER1”, indicating a single Paragon customer orchestrated the attack

Broader Graphite Backstory

Graphite has previously gained infamy. Notably, Meta-owned WhatsApp reported that Graphite was deployed against dozens of users globally, including Pellegrino’s colleague, journalist Francesco Cancellato, bringing the public count of known victims to at least seven

Earlier this week, Paragon announced it had ended contracts with the Italian government. The company cited Italy’s refusal to allow independent verification that the spyware wasn’t used against investigative journalists

Meanwhile, Italy’s Copasir (Parliamentary Committee for Republic Security) confirmed that Italian intelligence agencies used Graphite—but not on journalists—claiming it was deployed for law enforcement tasks including fugitive tracking, counter-terrorism, organized crime, smuggling, and counter-espionage .

Graphite’s infrastructure requires operator login credentials; every deployment generates logs. These logs reside on customer-controlled servers, not Paragon’s, introducing minimal external oversight

Risk and Global Implications

The Citizen Lab emphasized that journalists across Europe remain vulnerable to invasive digital surveillance, spotlighting how unchecked spyware proliferates and threatens privacy. The EU has already criticized such spyware use, calling for stringent export controls and stronger legal safeguards. These incidents are likely to intensify policy focus in Brussels and national capitals.

Apple’s threat notification system relies on threat intelligence; receiving an alert does not necessarily confirm infection—but signals suspicious activity.

Spyware Landscape: A Wider Context

While Graphite looms large, other spyware like Predator has also resurfaced. Recorded Future’s Insikt Group reports renewed Predator operations, including expansion into Mozambique and identification of new servers—highlighting persistent global spyware threats .

What You Can Do

• Update your devices: Ensure your Apple products are updated to the latest iOS, macOS, watchOS, or visionOS versions.
• Stay alert: If you receive a threat notification from Apple, treat it seriously—even if your device seems normal.
• Advocate for change: Encourage stronger legal frameworks to regulate commercial spyware and promote transparency in its deployment.

As zero-click spyware becomes more sophisticated, this case highlights the need for vigilance, transparency, and accountability. Users and policymakers must recognize that threats once limited to espionage circles can now penetrate the heart of civil society.

The post Apple’s Invisible Threat: Zero-Click Spyware Attack on Journalists via iMessage appeared first on CyberHood Sentinel.

Details of the Vulnerability

CVE-2025-2783 is described as an “incorrect handle provided in unspecified circumstances in Mojo on Windows.” Mojo is a set of runtime libraries facilitating platform-agnostic inter-process communication (IPC). The flaw allows attackers to bypass Chrome’s sandbox protections, enabling unauthorized access to the system.

Discovery and Exploitation

Researchers Boris Larin and Igor Kuznetsov from Kaspersky discovered and reported the vulnerability on March 20, 2025. The attacks, dubbed “Operation ForumTroll,” involved sophisticated phishing emails containing malicious links. Upon clicking these links, the victims’ systems were infected without any further action required. The phishing emails masqueraded as invitations from the organizers of the legitimate scientific forum, Primakov Readings, and targeted media outlets, educational institutions, and government organizations in Russia.

Google’s Response

In response to the active exploitation, Google released out-of-band fixes in Chrome version 134.0.6998.177/.178 for Windows. The company acknowledged the reports of the exploit in the wild but has not disclosed additional technical specifics about the attacks or the threat actors involved.

Recommendations for Users

Users of Chrome on Windows are strongly advised to update their browsers to the latest version immediately to mitigate potential threats. Additionally, users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply the available fixes promptly. It is also recommended to exercise caution with unsolicited emails and avoid clicking on unknown links to prevent potential infections.

This incident underscores the critical importance of timely software updates and vigilance against phishing attempts to maintain cybersecurity.

The post Google Releases Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability appeared first on CyberHood Sentinel.

Understanding the Ruby-SAML Vulnerabilities

The identified vulnerabilities, tracked as CVE-2025-25291 and CVE-2025-25292, have been assigned a CVSS score of 8.8, indicating a high severity level. These flaws impact:

• Ruby-SAML versions below 1.12.4
• Ruby-SAML versions 1.13.0 to 1.18.0 (excluding 1.18.0)

These security issues arise due to inconsistencies in how the REXML and Nokogiri libraries parse XML data, leading to potential authentication bypass scenarios. By exploiting these discrepancies, attackers can manipulate SAML responses, potentially logging in as any user within an organization.

How Attackers Can Exploit These Flaws

If an attacker obtains a valid signature created with the key used to validate SAML responses, they can craft malicious SAML assertions. This could allow them to:

• Bypass authentication protocols
• Gain unauthorized access to user accounts
• Compromise sensitive organizational data

Additional Security Risks: Denial-of-Service (DoS) Attack

Alongside authentication bypass risks, a related vulnerability (CVE-2025-25293) with a CVSS score of 7.7 was also discovered. This flaw enables attackers to launch remote denial-of-service (DoS) attacks by sending specially crafted compressed SAML responses, overwhelming the system and causing service disruptions.

How to Protect Your Organization

To mitigate these risks, immediate action is required. The maintainers of ruby-saml have released patched versions:

Upgrade to Ruby-SAML 1.12.4 or 1.18.0 to eliminate security vulnerabilities.

Regularly monitor and update dependencies to prevent exploitation of outdated libraries.

Implement additional security measures such as multi-factor authentication (MFA) to enhance protection against unauthorized access.

Conclusion: Stay Secure by Updating Immediately

The discovery of these ruby-saml vulnerabilities highlights the need for continuous security vigilance. Organizations using affected versions should urgently apply the patches to mitigate authentication bypass and DoS risks. Keeping software dependencies up to date is a critical step in safeguarding sensitive information from cyber threats.

For more information and the latest updates, visit the official GitHub Security Blog.

The post GitHub Uncovers Critical Ruby-SAML Vulnerabilities: Urgent Patch Required appeared first on CyberHood Sentinel.

Nature of the Vulnerability

The vulnerability arises from a prototype pollution issue within Kibana. Prototype pollution is a type of security flaw that allows attackers to manipulate an application’s JavaScript objects and properties. This manipulation can lead to unauthorized data access, privilege escalation, denial-of-service, or, as in this case, remote code execution. Specifically, the flaw can be exploited through a crafted file upload combined with specially crafted HTTP requests. ​

Affected Versions

All Kibana versions from 8.15.0 up to, but not including, 8.17.3 are affected by this vulnerability. The exploitability varies depending on the version:​

• Versions 8.15.0 to 8.17.0: Exploitable by users with the ‘Viewer’ role.​
• Versions 8.17.1 and 8.17.2: Exploitable by users possessing all of the following privileges:​
  • fleet-all​
  • integrations-all​
  • actions:execute-advanced-connectors​

Recommended Actions

Users are strongly advised to upgrade to Kibana version 8.17.3 immediately to mitigate this vulnerability. For those who cannot apply the update promptly, a temporary workaround involves disabling the Integration Assistant feature by setting xpack.integration_assistant.enabled: false in the Kibana configuration file (kibana.yml).

Previous Similar Vulnerabilities

This is not the first time Kibana has faced critical security issues. In August 2024, Elastic addressed another critical prototype pollution flaw (CVE-2024-37287) that could lead to code execution. Subsequently, in September 2024, two severe deserialization vulnerabilities (CVE-2024-37288 and CVE-2024-37285) were also patched, both of which could permit arbitrary code execution. ​

Conclusion

Given the critical nature of CVE-2025-25012, it is imperative for organizations using affected versions of Kibana to apply the necessary updates or mitigations without delay to protect their systems from potential exploitation.​

The post Elastic Releases Urgent Patch for Critical Kibana Vulnerability Allowing Remote Code Execution appeared first on CyberHood Sentinel.

The vulnerabilities can enable attackers to gain unauthorized access to the device, perform remote desktop takeover, or bypass the login brute force protection.

As per Citrix security Bulletin “The only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability,”

Citrix Gateway is an SSL VPN service providing secure remote access with identity and access management capabilities, widely deployed in the cloud or on on-premise company servers.

Citrix ADC is a load-balancing solution for cloud applications deployed in the enterprise, ensuring uninterrupted availability and optimal performance.

The following vulnerabilities are released as part of Citrix Advisory

CVE-2022-27516:Login brute force protection mechanism failure allowing its bypassing. This vulnerability can only be exploited if the appliance is configured as VPN (Gateway) or AAA virtual server with “Max Login Attempts” configuration.

CVE-2022-27513: Insufficient verification of data authenticity, allowing remote desktop takeover via phishing. The flaw is exploitable only if the appliance is configured as VPN (Gateway), and the RDP proxy functionality is configured.

CVE-2022-27510: Critical-severity authentication bypassing using an alternate path or channel, exploitable only if the appliance is configured as VPN (Gateway).

Citrix warns that “Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible,”

Following citrix versions are affected by the above vulnerabilities

• Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
• Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
• Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
• Citrix ADC 12.1-FIPS before 12.1-55.289
• Citrix ADC 12.1-NDcPP before 12.1-55.289

Customers who rely on Citrix for cloud-based management services don’t need to take any action, as the vendor has already applied the security updates.

The citrix versions before 12.1 do not need to take any actions on the vulnerabilities.

The post Citrix release patch for critical Authentication Bypass vulnerability appeared first on CyberHood Sentinel.

Thus far, the log4j vulnerability, tracked as CVE-2021-44228, has been abused by all kinds of threat actors from state-backed hackers to ransomware gangs and others to inject Monero miners on vulnerable systems.

Log4j usage is rampant among many software products and multiple vendor advisories have since surfaced. And, it now seems, ‘logback’ isn’t all that immune either.

Given Log4j’s vast usage in the majority of Java applications, Log4Shell soon turned into a nightmare for enterprises and governments worldwide.

Below are the CVEs in the order that they emerged that you should know about:

• CVE-2021-44228 [Critical]: The original ‘Log4Shell’ vulnerability is an untrusted deserialization flaw. Rated critical in severity, this one scores a 10 on the CVSS scale and grants remote code execution (RCE) abilities to unauthenticated attackers, allowing complete system takeover.
  
  Reported by Chen Zhaojun of Alibaba Cloud Security Team to Apache on November 24th, CVE-2021-44228 impacts the default configurations of multiple Apache frameworks, including Apache Struts2, Apache Solr, Apache Druid, Apache Flink, and others.
  
  Being the most dangerous of them all, this vulnerability lurks in the log4j-core component, limited to 2.x versions: from 2.0-beta9 up to and including 2.14.1. A fix for Log4Shell was rolled out in version 2.15.0 but deemed incomplete (keep reading).
  
• CVE-2021-45046 [Critical, previously Low]: This one is a Denial of Service (DoS) flaw scoring a 3.7 9.0. The flaw arose as a result of an incomplete fix that went into 2.15.0 for CVE-2021-44228. While the fix applied to 2.15.0 did largely resolve the flaw, that wasn’t quite the case for certain non-default configurations.
  
  Log4j 2.15.0 makes “a best-effort attempt” to restrict JNDI LDAP lookups to localhost by default. But, attackers who have control over the Thread Context Map (MDC) input data can craft malicious payloads via the JNDI Lookup patterns to cause DoS attacsk. This applies to non-default configurations in which a non-default Pattern Layout using either a Context Lookup, e.g. $${ctx:loginId}, or a Thread Context Map pattern (%X, %mdc, or %MDC).
  
  Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default,” states the NVD advisory. For those on 2.12.1 branch, a fix was backported into 2.12.2.
  
• CVE-2021-4104[High]: Did we say Log4j 2.x versions were vulnerable? What about Log4j 1.x?
  While previously thought to be safe, Log4Shell found a way to lurk in the older Log4j too. Essentially, non-default configuration of Log4j 1.x instances using the JMSAppender class also become susceptible to the untrusted deserialization flaw.
  
  Although a less severe variant of CVE-2021-44228, nonetheless, this CVE impacts all versions of the log4j:log4j and org.apache.log4j:log4j components for which only 1.x releases exist. Because these are end-of-life versions, a fix for 1.x branch does not exist anywhere, and one should upgrade to log4j-core 2.16.0.
  
• CVE-2021-42550 [Moderate]: This is a vulnerability in the Logback logging framework. A successor to the Log4j 1.x library, Logback claims to pick up “where log4j 1.x leaves off.”
  
  Up until last week, Logback also bragged that being “unrelated to log4j 2.x, [logback] does not share its vulnerabilities.”
  
  That assumption quickly faded when CVE-2021-4104 was discovered to impact Log4j 1.x as well, and the possibility of potential impact to Logback was assessed. Newer Logback versions, 1.3.0-alpha11 and 1.2.9 addressing this less severe vulnerability have now been released.
   
• CVE-2021-45105 [High]: Log4j 2.16.0 was found out to be vulnerable to a DoS flaw rated ‘High’ in severity. Apache has since released a log4j 2.17.0 version fixing the CVE.

Patch Log4j 2.15: DNS exfiltration & RCE possible

Log4j 2.15.0 might contain even more severe vulnerabilities than the ones discovered so far, which is why 2.16.0 is by far a safer bet.

Because of CVE-2021-45046 described above, the maximum impact from the flaw initially appeared to be DoS, but that assumption is evolving.

Cloud security firm Praetorian demonstrated how Log4j 2.15.0 versions could still be abused for DNS-based data exfiltration from external hosts, and is working with Apache towards a coordinated disclosure.

As Bleeping computer reports ” The Praetorian blog post is in response to CVE-2021-45046, which applies to Log4j version 2.15. The CVE description states that—when using a specific type of Pattern Layout—this vulnerability can lead to a denial of service. The reason they state it is DoS only is due to the localhost allowlist,” Weems tells BleepingComputer.

“We’ve developed a bypass for this ‘localhost’ allowlist and sent the details to Apache. At minimum, this means systems that are vulnerable to CVE-2021-45046 are not just vulnerable to DoS, but also DNS exfil of potentially sensitive environment variables. “

The worst possible scenario resulting from Log4j 2.15.0 is yet to be fully determined, but suffice to say, it doesn’t seem like it’s just limited to DoS.

The post All Log4j vulnerabilities in a Nutshell appeared first on CyberHood Sentinel.