Sep 05, 2025

Cyber risks aren’t slowing down, Digital Defenders.

Silent chat spyware, supply chain breaches, failing drives, Android zero-days, and a looming PoC exploit. The attack surface shifts fast—are your defenses keeping up?

Here’s what you need to know:

Zero-Day Download

Silent WhatsApp Exploit Turns Apple Devices into Spyware Targets

A zero-click flaw in WhatsApp for iOS and macOS was exploited in conjunction with a patched Apple ImageIO bug.

CVE-2025-55177 allows attackers to exploit linked device sync, chaining with CVE-2025-43300 for a full system compromise.

Silent WhatsApp Exploit Turns Apple Devices into Spyware Targets

Source: ChatGPT

This attack highlights how messaging apps remain key surveillance targets and are at risk from silent zero-click exploits. WhatsApp has rolled out patches for the vulnerability in its latest release.

Enforce mobile patching and regularly review security baselines to catch gaps before attackers do.

Cloudflare Falls Victim to Salesforce Supply Chain Intrusion

Cloudflare confirmed threat actor GRUB1 breached its Salesforce instance, stealing support data between Aug. 12–17, 2025.

The breach stemmed from a supply chain attack via the Salesloft Drift chatbot, affecting multiple organizations worldwide.

No core systems or attachments were breached, but contacts, API tokens, and pasted credentials may have been exposed. Cloudflare has conducted an investigation into the incident and has begun notifying the affected customers.

Rotate exposed credentials and audit all SaaS integrations.

Mystery SSD Meltdowns Put Windows Users on Edge

A wave of reports about SSD data corruption and sudden hardware failure had some Windows 11 users pointing fingers at Microsoft’s August 2025 security patch.

First reported in mid-August, the issue affects drives that are over 60% full during heavy writes, impacting brands such as Corsair, Kioxia, and SanDisk, as well as models with Phison or InnoGrit controllers. With no root cause yet identified, enterprise data risk remains high.

Microsoft maintains its KB5063878 update is not responsible, noting both internal tests and partner investigations found no correlation.

Monitor SSD health and keep backups up to date to minimize downtime and data loss.

Share this newsletter!

Pulse Check

If your SSD failed today, how prepared are you?

⚡ Fully Ready: I’ve got backups and monitoring in place

🛠️ Somewhat Ready: I’d scramble but recover eventually

🎲 Not Ready: I’d risk major data loss and downtime

Yesterday's Pulse Check Results

Driver Defense Check: How ready are you for BYOVD attacks?

Security Tools You Can Use

Top vulnerability management tools quickly identify risks with scoring, automated fixes, and continuous scanning.
Attackers only need one weak device to breach your network. NinjaOne MDM helps you lock down every endpoint before it becomes the entry point.
Level up your skills with ethical hacking, CySA+ prep, and more—now 65% off for a limited time..

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Hundreds of Millions of Devices at Risk from Android Zero-Days

Google’s Android Security Bulletin addresses two actively exploited zero-day vulnerabilities that potentially affect hundreds of millions of devices.

CVE-2025-38352 is a critical System RCE, and CVE-2025-48543 is a high-severity kernel privilege escalation.

Hundreds of Millions of Devices at Risk from Android Zero-Days

Source: ChatGPT

The System bug is particularly dangerous, as it requires no user interaction and could grant attackers full control of devices, while the kernel flaw grants root-level access across Android versions 13 through 16. Google has released patches for the vulnerabilities.

Ensure devices run the latest patch and press OEMs to accelerate fleet-wide updates.

PoC Exploit Released for Microsoft IIS WebDeploy Flaw

A PoC exploit was released for CVE-2025-53772, a critical RCE in Microsoft’s IIS Web Deploy.

The flaw arises from unsafe HTTP header deserialization in msdeploy services, enabling authenticated RCE. Rated 8.8 CVSS, it threatens .NET and DevOps environments using Web Deploy.

Researchers released a working PoC on GitHub, though the exploit hasn’t yet been observed in the wild.

Disable unused Web Deploy services, tighten network ACLs, and patch fast before PoCs become active exploits.

Security Tip of the Day

Are Your IoT Endpoints the Next DDoS Weapons?

From cameras to sensors, IoT devices are prime targets.

Botnets like RapperBot can hijack unsecured devices in seconds, weaponizing them for DDoS or deeper network breaches. Protecting IoT endpoints is imperative for resilience.

Are Your IoT Endpoints the Next DDoS Weapons?

Source: ChatGPT

How to lock down your IoT devices:

Change default credentials on devices.
Segment IoT networks to isolate critical systems.
Update firmware quickly to fix vulnerabilities.
Disable unused services like remote admin ports.
Monitor activity logs for unusual traffic.
Use discovery tools to secure unmanaged devices.
Add strong authentication to device management access.
Retire unsupported hardware that no longer receives updates.

Hardening IoT security not only blocks attackers from weaponizing devices but also fortifies overall resilience—segmentation and timely updates can stop major incidents before they start.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.