InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog, highlighting confirmed cases of these flaws being exploited in real-world scenarios. The catalog now features a zero-click iOS vulnerability exploited by mercenary spyware, as well as a command injection flaw in TP-Link routers that allows for remote code execution.
CVE-2025-43200 is a vulnerability in several Apple products caused by a logic error in managing photos and videos shared through iCloud Links. Apple fixed this issue in iOS 18.3.1 on February 10, 2025, but exploitation had started by early 2025.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Apple reported a flaw due to a logic error triggered by processing a malicious photo or video from an iCloud Link.
A recent investigation by Citizen Lab revealed that Paragon’s Graphite spyware—a sophisticated commercial surveillance tool—was exploited in targeted attacks. This spyware was introduced via a zero-click iMessage vulnerability, impacting devices operating on iOS 18.2.1.
Once the vulnerability was activated, spyware reached out to a command-and-control server (46.183.184[.]91) and secretly installed surveillance tools without the victim’s interaction.
CVE-2023-33538 is a vulnerability in TP-Link routers TL-WR940N V2/V4 and TL-WR841N V8/V10. It exists in the /userRpm/WlanNetworkRpm section of the web interface, allowing attackers to exploit the ssid1 GET parameter for command injection.
CISA requires all Federal Civilian Executive Branch agencies to fix vulnerabilities by July 7, 2025.
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
