WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS Devices

WhatsApp has addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 CVSS score: 5.4, relates to a case of...

PT-2025-35340

WhatsApp fixed a zero-click bug CVE-2024-55177 used in targeted spyware attacks affecting less than 200 iOS/Mac users. The exploit, combined with an Apple flaw CVE-2024-43300, allowed data theft. The attacker is unknown. https://t.co/NATZvQytTO...

Exploit for Out-of-bounds Write in Apple Ipados

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corrupti...

Exploit for Use After Free in Apple Ipados

Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

NTLM/SMB Hardening & Threat Hunt Toolkit Author: w01f...

AgentFlayer 0-click exploit abuses ChatGPT Connectors to Steal 3rd-party app data

AgentFlayer is a critical vulnerability in ChatGPT Connectors. Learn how this zero-click attack uses indirect prompt injection to…...

Researchers Uncover GPT-5 Jailbreak and Zero-Click AI Agent Attacks Exposing Cloud and IoT Systems

Cybersecurity researchers have uncovered a jailbreak technique to bypass ethical guardrails erected by OpenAI in its latest large language model LLM GPT-5 and produce illicit instructions. Generative artificial intelligence AI security platform NeuralTrust said it combined a known technique calle...

Exploit for Use After Free in Microsoft

🛑 CVE-2025-21298 – Critical Zero-Click RCE in Microsoft Window...

Preventing Zero-Click AI Threats: Insights from EchoLeak

A zero-click exploit called EchoLeak reveals how AI assistants like Microsoft 365 Copilot can be manipulated to leak sensitive data without user interaction. This entry breaks down how the attack works, why it matters, and what defenses are available to proactively mitigate this emerging AI-nativ...

CVE-2025-34072 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol MCP Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embeddin...

CVE-2025-34072 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol MCP Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embeddin...

PT-2025-27630 · Anthropic · Slack Model Context Protocol (Mcp) Server

Name of the Vulnerable Software and Affected Versions: Anthropic’s Slack Model Context Protocol MCP Server affected versions not specified Description: A data exfiltration issue exists in the deprecated Slack Model Context Protocol MCP Server via automatic link unfurling. When an AI agent using t...

The vulnerability of the Messages component in operating systems such as watchOS, macOS, iOS, and iPadOS allows a hacker to carry out a zero-click attack.

The vulnerability of the Messages component in operating systems such as watchOS, macOS, iOS, and iPadOS is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to carry out a zero-click attack using a specially crafted iCloud link...

📄 Glass Cage Zero-Click iMessage Exploit Details

Glass Cage, a vulnerability chain discovered on iOS 18.2, enables an attacker to compromise a device silently by sending a single malicious PNG image via iMessage. The exploit bypasses multiple layers of Apple's defenses, including BlastDoor, WebKit sandboxing, and CoreMedia memory protections...

Paragon Spyware Used to Spy on European Journalists

Paragon is an Israeli spyware company, increasingly in the news now that NSO Group seems to be waning. "Graphite" is the name of its product. Citizen Lab caught it spying on multiple European journalists with a zero-click iOS exploit: On April 29, 2025, a select group of iOS users were notified b...

Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware

Apple has disclosed that a now-patched security flaw present in its Messages app was actively exploited in the wild to target civil society members in sophisticated cyber attacks. The vulnerability, tracked as CVE-2025-43200, was addressed on February 10, 2025, as part of iOS 18.3.1, iPadOS 18.3....

EchoLeak Zero-Click AI Attack in Microsoft Copilot Exposes Company Data

Aim Labs uncovers EchoLeak, a zero-click AI flaw in Microsoft 365 Copilot that allows data theft via email. Learn how this vulnerability enables sensitive information exfiltration without user interaction and its implications for AI security...

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence AI vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 M365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the...

PT-2025-25295 · Undefined · Undefined

EchoLeak: First-Ever Zero-Click Vulnerability, CVE-2025-3271, Discovered by Aim Labs in Microsoft 365 Copilot AI, Allowed Attackers Steal Sensitive Data Silently, Now Fixed EchoLeak Hackers Microsoft Copilot CopilotAgent MIcrosoft365 @Microsoft @Copilot...

Apple iMessage Zero-Click Key Theft / Remote Code Execution

This is a strategic public disclosure of a zero-click iMessage exploit chain that was discovered live on iOS 18.2 and remained unpatched through iOS 18.4. It enabled Secure Enclave key theft, wormable remote code execution, and undetectable crypto wallet exfiltration. Despite responsible...