InfoSecBulletin Cybersecurity for mankind
An urgent warning about three important Apple flaws that are being used by hackers. These security flaws, known as CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, were added to CISA’s list of Known Exploited Vulnerabilities (KEV).
Security experts have connected this group of three flaws to the advanced DarkSword iOS attack method. Hackers use it together to take control and affect many Apple devices.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The DarkSword Exploit Mechanism
The DarkSword campaign uses these three different weaknesses to take over the entire system. The attack starts with CVE-2025-31277, a major buffer overflow problem that impacts several Apple operating systems.
This flaw occurs when the target’s device processes maliciously crafted web content, triggering immediate memory corruption within the web processing engine. This first step gives attackers the chance to run random code on the victim’s device with little user involvement.
Once access is gained, the exploit uses CVE-2025-43510 to get around internal security limits. This flaw comes from not checking the lock state correctly. This can seriously damage memory, allowing a bad app to make strange changes to memory used by different processes.
By taking advantage of this weakness, attackers can change shared memory to gain higher access and get the system ready to run the final payload.
The exploit chain culminates with the execution of CVE-2025-43520. This critical memory corruption issue affects the core of the operating system. Exploiting this local flaw lets a harmful app write directly to kernel memory or make the system crash suddenly.
By getting write access at the kernel level, attackers take full control of the hacked device, ignoring Apple’s built-in protections and allowing ongoing spying or data theft.
The scope of this vulnerability chain is exceptionally broad, affecting nearly the entire modern Apple ecosystem.
Because the underlying vulnerable components handle web content processing and fundamental kernel operations across different platforms, the threat extends far beyond just mobile phones.
The list of affected products includes Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS.
Mitigations:
To mitigate the issue, CISA requires federal agencies and strongly urges private companies to act quickly. System admins need to use the latest fixes and security updates from Apple, which are iOS 18.7.2, macOS Sequoia 15.7.2, and watchOS 26.1.
