CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-31277 | Buffer Overflow in Apple WebKit (Safari, iOS/iPadOS, macOS, WebKitGTK, WPE) CVE-2025-31277 is a memory-handling flaw (buffer overflow, CWE-119/CWE-120) in Apple's WebKit engine, the component that renders web content in Safari and in webviews across Apple platforms. It is triggered when a user processes maliciously crafted web content, typically by visiting an attacker-controlled page, causing memory corruption that can compromise the rendering process, with CVSS 3.1 scoring high impact to confidentiality, integrity and availability (8.8) via a network vector requiring user interaction but no privileges. Everyone running WebKit is affected: Safari users and devices on iOS/iPadOS, macOS Sequoia, tvOS, visionOS and watchOS prior to the fixed releases, plus Linux users of WebKitGTK and WPE WebKit as shipped with Red Hat Enterprise Linux (including the AUS and ELS channels). Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2026-03-20 (ransomware linkage unknown) with a BOD 22-01 remediation deadline of 2026-04-03, and contemporaneous reporting describes 'DarkSword', an iOS exploit kit chaining multiple Apple flaws, reportedly including zero-days, in global attacks, possibly including this bug. No public proof-of-concept is known, and fixes shipped in Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6. Do: Upgrade Safari to 18.6 or later and apply the corresponding OS updates: iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6; on Red Hat Enterprise Linux (including AUS/ELS) install Red Hat's updated WebKitGTK/WPE WebKit packages. Organizations subject to CISA BOD 22-01 must patch or mitigate by the April 3, 2026 deadline. Until patched, restrict WebKit-based browsing and webviews on affected devices to trusted content, since exploitation requires loading maliciously crafted web content. | 8.8 | 2% | KEV |
| mass≈1 billion+ users/devices (WebKit ships on essentially every active iPhone, iPad, Mac, Apple TV, Apple Watch and Vision Pro; the RHEL WebKitGTK/WPE WebKit… | |
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS Craft CMS contains a code injection vulnerability (CWE-94) that allows a remote attacker to execute arbitrary code on affected servers. CISA's listing does not specify the exact attack path or authentication requirements, but the flaw is remotely triggerable and grants arbitrary code execution, which typically means full compromise of the web server and a foothold for follow-on activity such as ransomware (ransomware use is not yet confirmed). Any organization running a Craft CMS instance is in scope, including internet-facing content sites and deployments where the Craft admin panel is reachable from the internet. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20, confirming exploitation in the wild, and EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is known. No CVSS score has been published yet, so defenders should treat the flaw as urgent given the KEV listing and near-certain EPSS likelihood. Do: Apply the patched Craft CMS release per the vendor's security advisory referenced in CISA's KEV entry (specific fixed version numbers are not provided in the source data), prioritizing internet-exposed instances, and U.S. federal agencies should follow BOD 22-01 requirements for KEV-listed flaws. Until patched, restrict network access to the Craft CMS control panel/admin interface and review web and application logs for signs of code injection or unexpected process execution, since exploitation in the wild is confirmed while ransomware use remains unknown. Given the 99.8% EPSS score and KEV listing, treat discovery and patching of all Craft CMS instances, including headless deployments, as an urgent, time-boxed task. | 10.0 | 100% | KEV PoC |
| mass≈100,000–200,000+ live Craft CMS sites (order of magnitude: ~10^5 internet-facing deployments) | |
| CVE-2025-43510 +1 in the same advisory: …43520 | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS CVE-2025-43510 is an improper locking flaw (CWE-667) in Apple's operating systems that leads to memory corruption, addressed by improved lock state checking. It is triggered locally: a malicious application already running on the device can cause unexpected changes in memory shared between processes, with the CVSS vector (AV:L, UI:R) indicating user interaction is required but no privileges needed beforehand. Successful exploitation could corrupt or expose cross-process shared memory, yielding high impacts on confidentiality, integrity, and availability (CVSS 3.1 score 7.8), and such shared-memory corruption bugs in Apple's OSes are commonly leveraged as steps in chained attacks such as sandbox escapes. All users of iOS, iPadOS, macOS (Sonoma, Sequoia, and Tahoe branches), tvOS, visionOS, and watchOS on versions earlier than the fixed releases are affected. The vulnerability is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-20 with a federal patching deadline of April 3, 2026, and news reports describe an active iOS exploit kit ('DarkSword') using multiple Apple flaws, including zero-days, in global attacks. Do: Update to the fixed releases: iOS/iPadOS 18.7.2 or iOS/iPadOS 26.1; macOS Sonoma 14.8.2, Sequoia 15.7.2, or Tahoe 26.1; tvOS 26.1; visionOS 26.1; and watchOS 26.1. As a local attack vector, prioritize patching devices that install untrusted apps, and federal agencies must apply the fixes under BOD 22-01 by April 3, 2026 per the CISA KEV listing. Given reports of the DarkSword iOS exploit kit chaining multiple Apple flaws in active attacks, treat unpatched iPhones and iPads as high priority and verify OS versions across your fleet. | 7.8 group max | <1% | KEV |
| mass>1 billion active Apple devices across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS (essentially the entire unpatched active install base) | |
| CVE-2025-54068 | Unauthenticated Code Injection RCE in Laravel Livewire v3 CVE-2025-54068 is an improper hydration flaw (CWE-94 code injection) in Livewire v3, a full-stack framework for Laravel, that allows unauthenticated attackers to achieve remote command execution in specific scenarios. The flaw is triggered when a Livewire component is mounted and configured in a particular way and receives certain component property updates, with no authentication or user interaction required. A successful attacker gains code execution on the server hosting the affected Laravel application. Only Livewire v3 up to and including v3.6.3 is affected; earlier major versions are not impacted, and the issue is fixed in v3.6.4. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2026-03-20, patching deadline 2026-04-03), indicating confirmed exploitation in the wild, and EPSS assigns a 96.5% probability of exploitation within 30 days. Do: Upgrade Livewire to v3.6.4 or later immediately, as no workarounds are available. Audit Laravel applications for Livewire v3 usage and identify components mounted and configured in the vulnerable property-hydration pattern, prioritizing internet-facing apps. Federal agencies must apply vendor mitigations or discontinue use by the BOD 22-01 deadline of April 3, 2026. | 9.2 | 97% | KEV |
| large≈10,000–100,000 Laravel application deployments (the subset of Livewire v3 installs using the vulnerable component mounting/property-update configuration) |
Full article683 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 21, 2026Vulnerability / Threat Intelligence
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them by April 3, 2026.
The vulnerabilities that have come under exploitation are listed below -
- CVE-2025-31277 (CVSS score: 8.8) - A vulnerability in Apple WebKit that could result in memory corruption when processing maliciously crafted web content. (Fixed in July 2025)
- CVE-2025-43510 (CVSS score: 7.8) - A memory corruption vulnerability in Apple's kernel component that could allow a malicious application to cause unexpected changes in memory shared between processes. (Fixed in December 2025)
- CVE-2025-43520 (CVSS score: 8.8) - A memory corruption vulnerability in Apple's kernel component that could allow a malicious application to cause unexpected system termination or write kernel memory. (Fixed in December 2025)
- CVE-2025-32432 (CVSS score: 10.0) - A code injection vulnerability in Craft CMS that could allow a remote attacker to execute arbitrary code. (Fixed in April 2025)
- CVE-2025-54068 (CVSS score: 9.8) - A code injection vulnerability in Laravel Livewire that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. (Fixed in July 2025)
The addition of the three Apple vulnerabilities to the KEV catalog comes in the wake of reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout about an iOS exploit kit codenamed DarkSword that leverages these shortcomings, along with three bugs, to deploy various malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER for data theft.
CVE-2025-32432 is assessed to have been exploited as a zero-day by unknown threat actors since February 2025, per Orange Cyberdefense SensePost. Since then, an intrusion set tracked as Mimo (aka Hezb) has also been observed exploiting the vulnerability to deploy a cryptocurrency miner and residential proxyware.
Rounding off the list is CVE-2025-54068, whose exploitation was recently flagged by the Ctrl-Alt-Intel Threat Research team as part of attacks mounted by the Iranian state-sponsored hacking group, MuddyWater (aka Boggy Serpens).
In a report published earlier this week, Palo Alto Networks Unit 42 called out the adversary's consistent targeting of diplomatic and critical infrastructure, including energy, maritime, and finance, across the Middle East and other strategic targets worldwide.
"While social engineering remains its defining trait, the group is also increasing its technological capabilities," Unit 42 said. "Its diverse toolset includes AI-enhanced malware implants that incorporate anti-analysis techniques for long-term persistence. This combination of social engineering and rapidly developed tools creates a potent threat profile."
"To support its large-scale social engineering campaigns, Boggy Serpens uses a custom-built, web-based orchestration platform," Unit 42 said. "This tool enables operators to automate mass email delivery while maintaining granular control over sender identities and target lists."
Attributed to the Iranian Ministry of Intelligence and Security (MOIS), the group is primarily focused on cyber espionage, although it has also been linked to disruptive operations targeting the Technion Israel Institute of Technology by adopting the DarkBit ransomware persona.
One of the defining hallmarks of MuddyWater's tradecraft has been the use of hijacked accounts belonging to official government and corporate entities in its spear-phishing attacks, and abuse of trusted relationships to evade reputation-based blocking systems and deliver malware.
In a sustained campaign targeting an unnamed national marine and energy company in the U.A.E. between August 16, 2025, and February 11, 2026, the threat actor is said to have conducted four distinct waves of attack, leading to the deployment of various malware families, including GhostBackDoor and Nuso (aka HTTP_VIP). Some of the other notable tools in the threat actor's arsenal include UDPGangster and LampoRAT (aka CHAR).
"Boggy Serpens' recent activity exemplifies a maturing threat profile, as the group integrates its established methodologies with refined mechanisms for operational persistence," Unit 42 said. "By diversifying its development pipeline to include modern coding languages like Rust and AI-assisted workflows, the group creates parallel tracks that ensure the redundancy needed to sustain a high operational tempo."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/cisa-flags-apple-craft-cms-laravel-bugs.html