Welcome to the latest issue of ONSEC Cyber Daily! Today, we're diving into a series of critical vulnerabilities and security warnings that are making waves in the cybersecurity world. First up, we're looking at the ongoing intrusions involving the CrushFTP vulnerability, a critical issue that's currently under active exploitation. Veteran cybersecurity journalist Dan Raywood brings us the details on this developing story. In other news, Apple has rolled out iOS 18.4 with a critical security warning for millions of iPhone users. The credit for discovering this vulnerability goes to cyber risk investigator Michael (Biscuit) Thomas. We're also covering the latest Ivanti bug, which when paired with malware, has earned an alert from CISA. Federal cybersecurity officials are warning about the powerful malware being used alongside the exploitation of this vulnerability in popular security tools. But it's not just iPhones and Ivanti at risk. We're also discussing an urgent warning for both iPhone and Android users, as certain settings could be leaving your device vulnerable to cyberattacks. In the world of cybersecurity convergence, we're exploring an international survey that found cybersecurity to be a top concern for CEOs, CSOs, and CISOs alike. In market news, Veza has launched an Identity Partner Program, offering alerts for system vulnerabilities and cybersecurity threats. Lastly, we're bringing you the latest in patching news, with Kaspersky discovering and patching a zero-day Chrome flaw, Apple patching critical vulnerabilities in iOS 15 and 16, and multiple Chrome vulnerabilities being addressed that could allow attackers to execute arbitrary code. Stay tuned for more details on these stories and more in today's issue of ONSEC Cyber Daily. Stay safe out there!

Exploits Alert

1. Intrusions Involving Critical CrushFTP Vulnerability Underway: Cybersecurity experts have reported a surge in intrusions involving a critical vulnerability in CrushFTP. The vulnerability is currently being exploited, putting numerous systems at risk. Source: SC Media UK
2. Apple Rolls Out iOS 18.4 With A Critical Security Warning: Apple has released iOS 18.4 with a critical security warning for millions of iPhone users. The update addresses a vulnerability discovered by cyber risk investigator Michael (Biscuit) Thomas. Source: HotHardware
3. Latest Ivanti Bug, Paired With Malware, Earns an Alert from CISA: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about a powerful malware exploiting a vulnerability in popular security tools from Ivanti. Source: The Record
4. Urgent Warning for iPhone and Android Users: An urgent warning has been issued for iPhone and Android users. Certain settings on these devices could potentially leave users vulnerable to cyber attacks, despite the use of secure messaging apps. Source: Unilad
5. CISA Alerts on Active Exploitation of Apache Tomcat Vulnerability: The CISA has issued an alert about the active exploitation of a vulnerability in Apache Tomcat. The alert emphasizes the growing need for enhanced vulnerability management within organizations. Source: GBHackers

Vulnerabilities & Patches

1. Kaspersky Discovers & Patches Zero-Day Chrome Flaw: Kaspersky has patched a zero-day vulnerability in Google Chrome, identified as CVE-2025-2783. The flaw was discovered by the security firm and has since been addressed to prevent potential exploitation. Source: SecurityBrief New Zealand
2. Apple Patches Critical Vulnerabilities in iOS 15 and 16: Apple has released patches for critical security vulnerabilities in iOS 15 and 16. The first vulnerability, designated CVE-2025-24200, has been addressed in the latest updates. Users are urged to update their devices immediately. Source: TechRepublic
3. Multiple Chrome Vulnerabilities Let Attackers Execute Arbitrary Code: Several vulnerabilities in Google Chrome, including a low-severity issue related to navigation handling (CVE-2025-3071), have been patched. These flaws could have allowed attackers to execute arbitrary code. Source: Cyber Security News
4. Exploited: Critical Unauthenticated Access Vulnerability in CrushFTP: A critical unauthenticated access vulnerability in CrushFTP, identified as CVE-2025-2825, has been exploited. Users are advised to update CrushFTP immediately and implement network protections if patching is delayed. Source: Security Boulevard
5. 20,000 WordPress Sites at Risk of File Upload & Deletion Exploits: Users of the WP Ultimate CSV Importer plugin are urged to update to version 7.19.1 or higher due to a vulnerability that puts 20,000 WordPress sites at risk of file upload and deletion exploits. Source: GBHackers

Podcasts

1. YC and You: Guarding the Future: This episode features Erik Knight discussing the future of cybersecurity, AI, and tech innovation. The conversation provides insights into the evolving landscape of technology and the importance of cybersecurity in protecting the future. Source: SignalsAZ
2. ThreatLocker: Zero Trust Endpoint Protection Platform: ThreatLocker's podcast episode focuses on their advanced cybersecurity solutions with a Zero Trust approach. The discussion revolves around how their platform protects organizations from malware and ransomware. Source: SourceForge Podcast
3. Securing the Software Supply Chain with HeroDevs: The CISO Series podcast episode discusses the importance of securing the software supply chain. The conversation with HeroDevs highlights the critical role of cybersecurity in ensuring the integrity of software development and distribution. Source: CISO Series

Final Words

And that's a wrap for today's edition of ONSEC Cyber Daily. We've navigated the labyrinth of cyber threats, vulnerabilities, and patches, bringing you the most critical updates from the world of cybersecurity. From the CrushFTP vulnerability to the latest iOS security warning, we've got you covered. Remember, in the digital world, knowledge is your best defense. So, don't keep this valuable information to yourself. Share ONSEC Cyber Daily with your friends and colleagues. Let's work together to create a safer cyber environment for all. Stay safe, stay informed, and see you in the next edition of ONSEC Cyber Daily.

x.com

X (formerly Twitter)

ONSEC.io | LinkedIn

ONSEC.io | 1,839 followers on LinkedIn. Information security audits and penetration testing by a team of experts with an average experience of more than 7 years | ONSEC.io - is a penetration testing & in-depth security audit company with more than 13 years of experience on the market. Our team has already helped more than 300 companies be aware about possible system's vulnerabilities, including Republic, DMarket, LegionFarm, Parallels, Xsolla, Acronis, Manyсhat, Global Fashion Group and others. Our main goal is to increase the customer security level by finding and fixing security issues as well as improve security awareness inside the company, including developers, DevOps, and other teams to build a sustainable engineering culture with security knowledge.

LinkedIn