Floating servers patching Apple zero-days and cloud vulnerabilities.

Daily Cybersecurity News - December 16, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

December 16, 2025 2:22 PM 5 min read

Apple Patches Zero-Day Vulnerabilities Exploited in Sophisticated Attacks

Critical

Executive Summary

Apple has released patches for actively exploited zero-day vulnerabilities, CVE-2025-43529 and CVE-2025-14174, in targeted attacks. The vulnerabilities impact WebKit and may have been leveraged in a coordinated campaign, requiring immediate patching of affected devices.

Vulnerability Details

Affected Product: WebKit in Safari, iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Specifically, iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later). Versions prior to iOS 26 are affected.
Identifier: CVE-2025-43529, CVE-2025-14174
CVSS Score: CVE-2025-43529 has a CVSSv3.1 score of 9.8 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Critical. Immediate patching is required to mitigate potential exploitation.
Attack Vector: Exploitation occurs through processing maliciously crafted web content. CVE-2025-43529 is a use-after-free vulnerability, and CVE-2025-14174 is a memory corruption issue.
Ease of Exploit: Exploits are sophisticated and targeted, likely used by commercial spyware vendors.

Action Plan

Immediate Action: Upgrade to iOS 26.2, iPadOS 26.2, iOS 18.7.3, iPadOS 18.7.3, macOS Tahoe 26.2, Safari 26.2, tvOS 26.2, watchOS 26.2, and visionOS 26.2.
Workaround: There are no known workarounds; patching is the primary mitigation.
Detection: Monitor for indicators of compromise (IOCs) associated with sophisticated attacks and enhance monitoring for unusual web content processing.

Relevant professional terms

Zero-day Vulnerability: A software vulnerability that is known to the software vendor but does not have a patch available, and is actively being exploited by attackers.
Use-After-Free: A type of memory corruption vulnerability where memory is incorrectly accessed after it has been freed, potentially leading to arbitrary code execution.

Source: Dark Reading

In-the-Wild Exploitation of Fortinet Authentication Bypass Vulnerabilities

Critical

Executive Summary

Threat actors are actively exploiting two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, against FortiGate appliances, potentially allowing unauthorized access and full system compromise. Immediate patching is crucial, and organizations should review logs for IOCs and ensure robust network segmentation.

Vulnerability Details

Affected Product: FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager
Identifier: CVE-2025-59718 and CVE-2025-59719
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching and investigation are critical.
Attack Vector: Attackers can bypass FortiCloud SSO login authentication via crafted SAML messages.
Ease of Exploit: Unauthenticated attackers can exploit the vulnerability if FortiCloud SSO is enabled.

Action Plan

Immediate Action: Upgrade to the latest fixed versions: FortiOS versions 7.6.4, 7.4.9, 7.2.12, and 7.0.18, FortiProxy versions 7.6.4, 7.4.11, 7.2.15, and 7.0.22, FortiSwitchManager versions 7.2.7 and 7.0.6, and FortiWeb versions 8.0.1, 7.6.5, and 7.4.10.
Workaround: Disable the FortiCloud login feature temporarily. To turn off FortiCloud login, go to System -> Settings -> Switch “Allow administrative login using FortiCloud SSO” to Off.
Detection: Monitor for suspicious administrative logins and geographical irregularities. Look for login attempts from unexpected countries.

Relevant professional terms

Authentication Bypass: A vulnerability that allows an attacker to circumvent security mechanisms and gain unauthorized access to a system or application.
Indicators of Compromise (IOCs): Data that indicates a system has been infiltrated by a cyber threat, used for malware detection and incident response.

Source: SecurityWeek

React2Shell Exploitation Leads to Backdoor Deployment

Executive Summary

Threat actors are actively exploiting the React2Shell vulnerability to deploy Linux backdoors like KSwapDoor and ZnDoor. Successful exploitation allows remote code execution (RCE) and persistent compromise of vulnerable systems.

Key TTPs

Initial Access: Exploitation of React2Shell vulnerability (CVE-2025-55182) via crafted HTTP requests.
Execution: Remote code execution on the server.
Defense Evasion: User agent randomization to deter detection.

Campaign Analysis

The React2Shell vulnerability allows unauthenticated attackers to execute arbitrary code by sending a single HTTP request. Observed exploitation includes the deployment of coin miners and Sliver payloads to Linux hosts.

Targeting & Infrastructure

Target Profile: Internet-facing Next.js applications and Kubernetes containers.
Infrastructure: Exploitation activity originates from IPs historically associated with China state-nexus threat actors.

Actionable Intelligence

IPs: [Observed IOCs are actively tracked and updated by security vendors; refer to threat intelligence feeds for the latest indicators]
Domains: [Observed IOCs are actively tracked and updated by security vendors; refer to threat intelligence feeds for the latest indicators]
Hashes: [Observed IOCs are actively tracked and updated by security vendors; refer to threat intelligence feeds for the latest indicators]

Relevant Terms

RCE (Remote Code Execution): The ability to execute arbitrary code on a remote computer.
IOC (Indicator of Compromise): Artifacts observed on a network or in an operating system that indicate a computer intrusion.

Source: The Hacker News

Ink Dragon's ShadowPad Relay Network

Executive Summary

Ink Dragon, a PRC-aligned espionage group, targets government, telecom, and public-sector infrastructure, with a growing focus on Europe. The group leverages a custom ShadowPad IIS Listener module to create a victim-based relay network.

Key TTPs

Initial Access: Exploits IIS misconfigurations, specifically predictable or mismanaged ASP.NET machineKey values, to perform ViewState deserialization attacks.
Execution: Employs a custom ShadowPad IIS Listener module to transform compromised servers into C2 nodes.
Defense Evasion: Uses advanced evasion techniques for stealthy lateral movement and multi-stage malware deployment.

Campaign Analysis

Ink Dragon is evolving its operations with new TTPs and tools, including a new variant of FinalDraft malware. The actor's campaigns combine solid software engineering and disciplined operational playbooks to blend into normal enterprise telemetry.

Targeting & Infrastructure

Target Profile: Government, telecom, and public-sector infrastructure, initially in Southeast Asia and South America, but increasingly in Europe.
Infrastructure: Leverages a distributed mesh network of compromised servers using a ShadowPad IIS Listener module.

Relevant Terms

IIS: Internet Information Services, a Microsoft web server.
C2: Command and Control, infrastructure used by attackers to control compromised systems.

Source: Check Point Research

Improving Cybersecurity with Architecture Diagrams

Executive Summary

The NCSC emphasizes the importance of architecture diagrams in cybersecurity, highlighting their utility for both Red and Blue Teams in understanding system environments and improving security operations. These diagrams facilitate better reconnaissance, attack path identification, monitoring, and incident response.

Key Findings

For Red Teams, architecture diagrams enable a deeper understanding of target environments, aiding in reconnaissance and attack path identification.
Blue Teams and SOC analysts can leverage architectural representations to accurately define monitoring scope and understand system interdependencies.
Clear diagrams streamline incident response and security control implementation, improving overall security operations.

The Bottom Line

Implementing and utilizing well-structured architecture diagrams can significantly enhance an organization's cybersecurity posture. By providing a clear and accessible overview of system design, these diagrams enable security teams to proactively identify vulnerabilities, improve incident response strategies, and ensure that security measures are effectively implemented and maintained. This ultimately leads to more robust and resilient systems that are better protected against evolving cyber threats.

Relevant Terms

Red Team: A group of ethical security professionals who simulate real-world cyberattacks to test an organization's defenses.
Blue Team: An internal IT security team that defends against cyberattacks by identifying security flaws and ensuring the effectiveness of security measures.

Source: NCSC.GOV.UK