Loading story…
Apple has backported a fix for CVE-2025-43300, an ImageIO out-of-bounds write vulnerability exploited in sophisticated attacks targeting specific individuals. The flaw was chained with a WhatsApp vulnerability (CVE-2025-55177) in highly-targeted spyware campaigns affecting fewer than 200 users. Updates are now available for both current and older iOS, iPadOS, and macOS devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Italian digital forensics firm Forenser reported a zero-click campaign targeting iPhones running iOS 16 that hijacked WhatsApp accounts without user interaction. The attackers allegedly exploited CVE-2025-43300 in ImageIO, and possibly CVE-2025-55177, to extract cryptographic material, instantiate rogue WhatsApp sessions, and send fraudulent money-transfer requests from victims' accounts.
Apple released security updates to fix a decade-old iOS zero-day vulnerability that had been exploited in the wild. The patch disclosure marks the first substantive event captured for this story.
A GitHub repository publicly described the 'Glass Cage' zero-click PNG-based iOS 18.2.1 exploit chain, linking ImageIO, WebKit, and Core Media flaws to achieve sandbox escape, kernel-level access, and device compromise via iMessage. The publication exposed technical details of the attack chain before Apple's later patch release.
Initial story creation
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcetheregister.com
Open sourcegithub.com
Open sourcethecyberthrone.in
Open sourcethehackernews.com
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple and Meta have patched a critical zero-day vulnerability (CVE-2025-43300) in the ImageIO framework, which was reportedly exploited in highly targeted attacks. Meta warned that attackers may have chained this Apple OS-level flaw with a WhatsApp bug (CVE-2025-55177) to target specific users, likely via commercial surveillanceware. Amnesty International and other researchers are investigating the campaign, which appears to impact both iOS and Android users, including civil society members.
Jun 29, 2026
Apple disclosed multiple security fixes for supported iPhone and iPad devices, including `CVE-2025-24200`, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and `CVE-2025-43200`, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue. Further reporting tied `CVE-2025-43200` to a zero-click Messages exploitation chain used to install Paragon's **Graphite** spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for `iOS 26.0.1` and `iPadOS 26.0.1` fixed `CVE-2025-43400`, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.
Jul 24, 2026Apple and France's CERT-FR have confirmed four separate waves of mercenary spyware attacks targeting high-profile individuals in France in 2025. The attacks leveraged zero-day vulnerabilities, including a recent chain involving CVE-2025-43300 (Apple iOS) and CVE-2025-55177 (WhatsApp), and required no user interaction. Apple has issued targeted threat notifications and recommends immediate security actions for affected users.
Jun 29, 2026