InfoSecBulletin Cybersecurity for mankind
CISA has listed a critical zero-day vulnerability affecting various Apple products in its Known Exploited Vulnerabilities catalog, indicating it is being actively exploited. CVE-2025-43529 is a severe use-after-free vulnerability in WebKit, Apple’s rendering engine, affecting millions of users on iOS, iPadOS, macOS, and other Apple platforms.
A use-after-free vulnerability (CWE-416) in WebKit can cause memory corruption when a user visits a malicious webpage. CISA confirmed that threat actors are exploiting this vulnerability, leading to its addition to the KEV catalog on December 15, 2025.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The vulnerability is a serious method for various attacks, such as remote code execution, unauthorized file access, and moving through compromised systems.
Organizations must respond to this threat by January 5, 2026, based on the 21-day remediation period set by CISA’s guidance.
The vulnerability is not yet linked to ransomware campaigns, but confirmed exploitation suggests that advanced threat actors could weaponize it.
CISA advises organizations to address this vulnerability by following the BOD 22-01 guidelines. They should promptly implement vendor-supplied mitigations and security patches as soon as Apple provides them.
