Welcome to the ONSEC Cyber Daily, your one-stop source for the latest in cybersecurity news. In today's issue, we're sounding the alarm on a massive security flaw found in Apple devices. The vulnerability, ominously dubbed "AirBorne," has security researchers urging iPhone users to disable AirPlay immediately to prevent potential hacking threats. In other news, Attaxion has integrated its EASM Platform with ENISA's EU Vulnerability Database, a move that promises to enhance external attack surface management. Meanwhile, the logistics sector is on high alert following recent cyber attacks that have exposed vulnerabilities in transport and fleet operations. We also delve into the world of patch management, discussing how organizations can adopt a security-first approach to closing vulnerability windows. We highlight the exploits of SideWinder APT hackers who are taking advantage of legacy office vulnerabilities to deploy malware undetected. Finally, we bring you the latest from the podcast world. Tune in to episodes from the FBI's "Ahead of the Threat," CyberWire's daily podcast, and new series like "The MSP Security Playbook" and "Cyber Made Human." These episodes offer valuable insights into making security decisions in unstable environments, the new threat landscape of generative AI, and much more. Stay safe, stay informed, and stay ahead of the threats with ONSEC Cyber Daily.

Exploits Alert

1. Massive Security Flaw Found in Apple Devices: A significant vulnerability, known as "AirBorne," has been discovered in Apple devices. Security experts advise users to disable AirPlay to prevent potential cyber attacks. Source: the420.in
2. Attaxion Integrates its EASM Platform with ENISA's EU Vulnerability Database: Attaxion, a leading EASM vendor, has integrated its platform with ENISA's EU Vulnerability Database, enhancing its asset coverage and security capabilities. Source: Security Boulevard
3. Disable AirPlay on iPhone to Prevent Hacking Threat: Apple users are urged to disable the AirPlay feature on their iPhones due to the discovery of 23 serious vulnerabilities that pose a significant cybersecurity threat. Source: Samaa TV
4. Logistics Sector on Alert After Recent Cyber Attacks: Recent cyber attacks have exposed vulnerabilities in the transport and fleet operations of the logistics sector, highlighting the urgent need for improved cybersecurity measures. Source: FleetPoint
5. CYRISMA's Mark Balovnev on Bringing Cybersecurity to Everyone: CYRISMA CEO Mark Balovnev discusses his company's ethos of making cybersecurity accessible to everyone, emphasizing the importance of proactive measures in preventing cyber attacks. Source: MSSP Alert

Vulnerabilities & Patches

1. ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows: ThreatLocker has introduced a security-first approach to patch management, aiming to close vulnerability windows as soon as a critical CVE drops. This approach is designed to help organizations stay ahead of potential threats. Source: BleepingComputer
2. SideWinder APT Hackers Exploits Legacy Office Vulnerabilities to Deploy Malware Undetected: SideWinder APT hackers are exploiting legacy Office vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882, to deploy malware undetected. These vulnerabilities have persisted in many organizations due to inadequate patch management. Source: GBHackers
3. Acronis TRU Reveals SideWinder's Geofenced Malware Targeting Regional Defense and Financial Bodies: Acronis TRU has revealed that SideWinder's geofenced malware is targeting regional defense and financial bodies, particularly in South Asia. The organization urges these bodies to immediately patch vulnerabilities CVE-2017-0199 and CVE-2017-11882. Source: CXOToday

Podcasts

1. Ahead of the Threat Podcast - Episode Ten - Hugh Thompson - FBI: This episode features Bryan Vorndran, assistant director of the FBI Cyber Division, discussing the latest cyber threats at RSA 2025 in San Francisco. Source: FBI
2. Bear in the network - CyberWire: CyberWire's Daily Podcast episode 2313, aired on 5.21.25, discusses the latest cyber threats and security news. Source: CyberWire
3. Making Security Decisions in an Unstable or Chaotic Environment: This episode of The Security Podcasts features Dave Coxe, CEO and Co-Founder of ID Dataweb, discussing how leaders can make security decisions in unstable or chaotic environments. Source: Security Magazine
4. Heimdal Launches New Podcast: The MSP Security Playbook: The first episode of Heimdal's new podcast features Nigel Moore, founder of The Tech Tribe, discussing how MSPs can move beyond reactive IT. Source: PR Newswire
5. Silicon UK AI For Your Business Podcast: The New Threat Landscape of Generative AI: This episode explores the critical questions facing today's security leaders: How has the cybersecurity threat landscape shifted over the years? Source: Silicon UK

Final Words

And that's a wrap for today's edition of ONSEC Cyber Daily. We hope you found our coverage on the latest cybersecurity threats, vulnerabilities, and solutions informative and helpful. Remember, staying safe in the digital world is a shared responsibility. So, don't keep this crucial information to yourself. Share this newsletter with your friends, colleagues, and loved ones to help them stay one step ahead of cyber threats. Let's work together to create a safer digital community. Stay vigilant, stay informed, and stay safe. We'll be back tomorrow with more cybersecurity updates. Until then, keep your devices secure and your data protected. Remember, in the world of cybersecurity, knowledge is the best defense. Signing off, ONSEC Cyber Daily Team

ONSEC.io | LinkedIn

ONSEC.io | 1,839 followers on LinkedIn. Information security audits and penetration testing by a team of experts with an average experience of more than 7 years | ONSEC.io - is a penetration testing & in-depth security audit company with more than 13 years of experience on the market. Our team has already helped more than 300 companies be aware about possible system's vulnerabilities, including Republic, DMarket, LegionFarm, Parallels, Xsolla, Acronis, Manyсhat, Global Fashion Group and others. Our main goal is to increase the customer security level by finding and fixing security issues as well as improve security awareness inside the company, including developers, DevOps, and other teams to build a sustainable engineering culture with security knowledge.

LinkedIn

x.com

X (formerly Twitter)