⚡ Weekly Recap: WhatsApp 0-Day, Docker Bug, Salesforce Breach, Fake CAPTCHAs, Spyware App & More

Summary: WhatsApp patched CVE-2025-55177, an insufficient authorization flaw in linked device synchronization messages that could let an unrelated user trigger processing of content from an arbitrary URL on a target's device, and said it may have been chained with Apple's CVE-2025-43300 in targeted zero-day attacks. WhatsApp sent in-app threat notifications to fewer than 200 users who may have been targeted in the spyware campaign.
What's compelling: Fewer than 200 users were notified, which means the exploit was narrow and targeted rather than mass-market - the kind of campaign that rarely trips broad perimeter defenses and is usually caught only by vendor-side detection.

Read the original at The Hacker News ↗