⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, Last Pass Fines, .NET RCE, OAuth Scams & More

Summary: Apple released security updates across iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to address two zero-days, CVE-2025-14174 (a memory corruption issue) and CVE-2025-43529 (a use-after-free bug), both exploitable via maliciously crafted web content to execute arbitrary code. CVE-2025-14174 also resides in the open-source ANGLE library and was addressed by Google in Chrome, and the article says evidence points to the flaws likely being weaponized by commercial spyware vendors.
Why it matters: Two zero-days were exploited in highly targeted attacks before fixes were broadly available, and the article ties them to commercial spyware vendors - a reminder that the browser and phone your executives use daily are the same attack surface being sold to the highest bidder.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-10573 CVE-2025-11838 CVE-2025-12026 CVE-2025-12029 CVE-2025-12195 CVE-2025-12196 CVE-2025-12562 CVE-2025-12716 CVE-2025-13184 CVE-2025-13390 CVE-2025-13607 CVE-2025-14174 CVE-2025-24857 CVE-2025-27019 CVE-2025-27020 CVE-2025-42880 CVE-2025-42928 CVE-2025-43529 CVE-2025-55183 CVE-2025-55184 CVE-2025-55754 CVE-2025-58083 CVE-2025-59718 CVE-2025-59719 CVE-2025-62221 CVE-2025-63216 CVE-2025-63224 CVE-2025-64113 CVE-2025-64126 CVE-2025-64127 CVE-2025-64128 CVE-2025-64775 CVE-2025-65106 CVE-2025-65108 CVE-2025-65883 CVE-2025-66489 CVE-2025-66567 CVE-2025-66570 CVE-2025-67635 CVE-2025-67779 CVE-2025-8110 CVE-2025-8405 CVE-2025-9612 CVE-2025-9613 CVE-2025-9614
Related: Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws Cyber Risks ·
Fortinet Forti Gate Under Active Attack Through SAML SSO Authentication Bypass Cyber Risks ·
Watch Guard Warns of Active Exploitation of Critical Fireware OS VPN Vulnerability Cyber Risks ·