InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog, highlighting confirmed cases of these flaws being exploited in real-world scenarios. The catalog now features a zero-click iOS vulnerability exploited by mercenary spyware, as well as a command injection flaw in TP-Link routers that allows for remote code execution.
CVE-2025-43200 is a vulnerability in several Apple products caused by a logic error in managing photos and videos shared through iCloud Links. Apple fixed this issue in iOS 18.3.1 on February 10, 2025, but exploitation had started by early 2025.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Apple reported a flaw due to a logic error triggered by processing a malicious photo or video from an iCloud Link.
A recent investigation by Citizen Lab revealed that Paragon’s Graphite spyware—a sophisticated commercial surveillance tool—was exploited in targeted attacks. This spyware was introduced via a zero-click iMessage vulnerability, impacting devices operating on iOS 18.2.1.
Once the vulnerability was activated, spyware reached out to a command-and-control server (46.183.184[.]91) and secretly installed surveillance tools without the victim’s interaction.
CVE-2023-33538 is a vulnerability in TP-Link routers TL-WR940N V2/V4 and TL-WR841N V8/V10. It exists in the /userRpm/WlanNetworkRpm section of the web interface, allowing attackers to exploit the ssid1 GET parameter for command injection.
CISA requires all Federal Civilian Executive Branch agencies to fix vulnerabilities by July 7, 2025.
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
