Saturday , February 15 2025

Apple Ships Urgent iOS Patch for Newly Exploited Zero-Days

Apple on Friday pushed out a major iOS security update to fix a pair of zero-day vulnerabilities already being exploited in the wild.

The newest iOS 16.4.1 and iPadOS 16.4.1 updates cover code execution software flaws in IOSurfaceAccelerator and WebKit, suggesting a complex exploit chain was detected in the wild hitting the latest iPhone devices.

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products

“Apple is aware of a report that this issue may have been actively exploited,” Cupertino says in a barebones advisory that credits Google and Amnesty International with reporting the issue.

The advisory documents two separate issues — CVE-2023-28205 and CVE-2023-28206 — that expose iPhones and iPads to arbitrary code execution attacks.

Apple described the IOSurfaceAccelerator flaw as an out-of-bounds write issue that was addressed with improved input validation.

The WebKit bug, which has already been exploited via web content to execute arbitrary code with kernel privileges, has been fixed with improved memory management.

The company did not say if the newly discovered exploits are capable of bypassing the Lockdown Mode feature that Apple shipped to deter these types of attacks.

The iOS patch comes alongside news from Google that commercial spyware vendors are burning through zero-days to infect mobile devices with surveillance malware.

In one of the two campaigns described by Google this week, an attack started with a link being sent to the targeted user via SMS. When clicked, the link took the victim to malicious websites delivering Android or iOS exploits — depending on the target’s device. Once the exploits were delivered, victims were redirected to legitimate websites, likely in an effort to avoid raising suspicion.

The iOS exploit chain also hit a WebKit vulnerability (CVE-2022-42856) that Apple patched in iPhones in December 2022. Attacks also involved a Pointer Authentication (PAC) bypass technique, and an exploit for CVE-2021-30900, a sandbox escape and privilege escalation vulnerability that Apple patched in iOS in 2021.

So far this year, there have been at least 24 documented zero-day vulnerabilities exploited in the wild prior to discovery.

Check Also

Indian Bank

Sophisticated malware attack on Indian Banks; Exposes 50,000 users

The zLabs research team found a mobile malware campaign with nearly 900 malware samples aimed …

Leave a Reply

Your email address will not be published. Required fields are marked *