glass-cage-i18-2025-24085-and-cve-2025-24201

Original Fork Network Left Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE-2025-24201 – WebKit Remote Code Execution CVE-2025-24085 – Core Media Privilege Escalation Reported to Apple: January 9, 2025 Patched: February–March 2025 Tested On: iPhone 14 Pro Max iOS 18.2.1 CVSS Base Score...

iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201

CVE-2025-31200 & CVE-2025-31201 | iMessage Zero-Click RCE Chain Summary This repository documents research into a zero-click remote exploit chain affecting iOS 18.x and beyond. A malformed AMR audio file delivered via iMessage triggers: 1. Heap corruption in CoreAudio CVE-2025-31200 — in...

malware-ioc

Lucid The Lucid Phishing-as-a-Service PhAAS platform, developed by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services. Utilizing advanced technologies like RCS and iMessage, the group employs automated tools and evasi...

Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201

Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE-2025-43300: O.o.B Wrrite in ImageIO CVE-2025-24201: WebKit Remote Code Execution CVE-2025-24085: Core Media Privilege Escalation Patched: Jan-March 2025 Tested On: iPhone 14 Pro Max iOS 18.2.1 VirusTotal Analysis Verified Hash Summary...

CVE-2025-31200-iOS-AudioConverter-RCE

CVE-2025-31200 – iOS AudioConverterService Zero-Click RCE Public disclosure of CVE-2025-31200 – a zero-click remote code execution RCE vulnerability in Apple's iOS 18.X, specifically within the AudioConverterService component. The vulnerability is triggered by a malicious audio file delivered via...

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware, according to new findings from the Citizen Lab in collaboration with the SHARE Foundation. "Our analysis confirmed that an iMessage zero-click exploit was used to infect the device...

Malicious Package

Overview claude-channel-imessage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

ios-imessage-zero-click-exploit

CVE-2025-31200/31201 - iOS Zero-Click iMessage Exploit Chai...

BITTER APT Uses Signal, Google, and Zoom Lures to Spread ProSpy Spyware

BITTER APT spreads ProSpy and ToSpy via Signal, Google, and Zoom lures, targeting journalists through LinkedIn and iMessage spearphishing...

OpenClaw OS Command Injection Vulnerability (CNVD-2026-19447)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability stems from an uncleared remote attachment path in the iMessage attachment staging process that contains shell metacharacters and i...

EUVD-2026-17371

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32917

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32917

OpenClaw prior to 2026.3.13 is affected by a remote command injection vulnerability in the iMessage attachment staging flow. The issue arises because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, allowing arbi...

CVE-2026-32917

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32917 OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32917 OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32917 OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

OpenClaw operating system command injection vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability stems from an uncleared remote attachment path in the iMessage attachment staging process that contains shell metacharacters and i...

CVE-2026-32917: Improper Neutralization of Special Elements used in an OS Command

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters...

CVE-2026-32030

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachment fetching is enabled. An attacker who can tamper with attachment path metadata can disclose files readable by the...