InfoSecBulletin Cybersecurity for mankind
Meta’s WhatsApp Security Team has fixed a zero-day vulnerability (CVE-2025-55177) in WhatsApp for iOS (before v2.25.21.73), WhatsApp Business for iOS (before v2.25.21.78), and WhatsApp for Mac (before v2.25.21.78).
According to the advisory, “Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.”
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
The WhatsApp Security Team noted: “We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.”
Apple explains: “An out-of-bounds write occurs when attackers successfully exploit such vulnerabilities by supplying input to a program, causing it to write data outside the allocated memory buffer.”
This type of flaw can cause:
Crashes or instability,
Data corruption, or
Remote Code Execution (RCE) in the worst-case scenario.
Image I/O manages various image formats, so an attacker could embed malicious code in an image to execute arbitrary commands at the OS level.
While both vulnerabilities are dangerous independently, their combined exploitation is what makes this attack particularly alarming.
CVE-2025-55177 in WhatsApp let attackers manipulate victim devices into downloading and processing harmful content from their URLs.
CVE-2025-43300 allowed attackers to execute remote code on the device using a malicious payload.
This chain gave attackers a discreet and effective way to launch attacks with little user involvement, a tactic typical of advanced operations linked to nation-state actors or wealthy surveillance firms.
WhatsApp users should immediately update to:
WhatsApp for iOS v2.25.21.73 or later,
WhatsApp Business for iOS v2.25.21.78 or later,
WhatsApp for Mac v2.25.21.78 or later.
Apple users should install the latest security updates for iOS, iPadOS, and macOS, which patch CVE-2025-43300 in Image I/O.
The risk for average users may be low, but for high-value targets like journalists, diplomats, human rights defenders, and executives, it’s urgent.
3 critical vulnerabilities affect Hikvision product: Patch Now
