InfoSecBulletin Cybersecurity for mankind
An urgent warning about three important Apple flaws that are being used by hackers. These security flaws, known as CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, were added to CISA’s list of Known Exploited Vulnerabilities (KEV).
Security experts have connected this group of three flaws to the advanced DarkSword iOS attack method. Hackers use it together to take control and affect many Apple devices.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The DarkSword Exploit Mechanism
The DarkSword campaign uses these three different weaknesses to take over the entire system. The attack starts with CVE-2025-31277, a major buffer overflow problem that impacts several Apple operating systems.
This flaw occurs when the target’s device processes maliciously crafted web content, triggering immediate memory corruption within the web processing engine. This first step gives attackers the chance to run random code on the victim’s device with little user involvement.
Once access is gained, the exploit uses CVE-2025-43510 to get around internal security limits. This flaw comes from not checking the lock state correctly. This can seriously damage memory, allowing a bad app to make strange changes to memory used by different processes.
By taking advantage of this weakness, attackers can change shared memory to gain higher access and get the system ready to run the final payload.
The exploit chain culminates with the execution of CVE-2025-43520. This critical memory corruption issue affects the core of the operating system. Exploiting this local flaw lets a harmful app write directly to kernel memory or make the system crash suddenly.
By getting write access at the kernel level, attackers take full control of the hacked device, ignoring Apple’s built-in protections and allowing ongoing spying or data theft.
The scope of this vulnerability chain is exceptionally broad, affecting nearly the entire modern Apple ecosystem.
Because the underlying vulnerable components handle web content processing and fundamental kernel operations across different platforms, the threat extends far beyond just mobile phones.
The list of affected products includes Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS.
Mitigations:
To mitigate the issue, CISA requires federal agencies and strongly urges private companies to act quickly. System admins need to use the latest fixes and security updates from Apple, which are iOS 18.7.2, macOS Sequoia 15.7.2, and watchOS 26.1.
