U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog

Yii 2 versions before 2.0.52 mishandle the attaching of behaviors defined with an __class array key, reintroducing the flaw fixed for CVE-2024-4990, an unauthenticated remote code execution issue (CWE-424, improper protection of alternate path). The defect is triggered remotely without authentication when a vulnerable application attaches behaviors this way, giving an attacker high-impact code execution (CVSS 9.8). Any application built on a vulnerable Yii 2 release is affected, most prominently Craft CMS sites, which were the target of an observed in-the-wild campaign between February and April 2025. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-02, carries an 84.6% EPSS probability of exploitation within 30 days, and a public SensePost writeup documents the active Craft CMS exploitation campaign. The top headline reports that hundreds of servers were likely compromised in that campaign.

Do: Upgrade Yii 2 to version 2.0.52 or later; Craft CMS operators should immediately update Craft CMS to its patched release that bundles fixed Yii, and confirm the resolved framework version on the system. Because the campaign ran from February through April 2025, review web/application logs and hosted files for indicators from the SensePost writeup, treating any unpatched internet-facing Yii 2 or Craft CMS host as likely compromised. Federal agencies must apply the KEV required action (vendor mitigations or BOD 22-01 guidance) by the CISA deadline.

CVE-2025-31277 is a memory-handling flaw (buffer overflow, CWE-119/CWE-120) in Apple's WebKit engine, the component that renders web content in Safari and in webviews across Apple platforms. It is triggered when a user processes maliciously crafted web content, typically by visiting an attacker-controlled page, causing memory corruption that can compromise the rendering process, with CVSS 3.1 scoring high impact to confidentiality, integrity and availability (8.8) via a network vector requiring user interaction but no privileges. Everyone running WebKit is affected: Safari users and devices on iOS/iPadOS, macOS Sequoia, tvOS, visionOS and watchOS prior to the fixed releases, plus Linux users of WebKitGTK and WPE WebKit as shipped with Red Hat Enterprise Linux (including the AUS and ELS channels). Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2026-03-20 (ransomware linkage unknown) with a BOD 22-01 remediation deadline of 2026-04-03, and contemporaneous reporting describes 'DarkSword', an iOS exploit kit chaining multiple Apple flaws, reportedly including zero-days, in global attacks, possibly including this bug. No public proof-of-concept is known, and fixes shipped in Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6.

Do: Upgrade Safari to 18.6 or later and apply the corresponding OS updates: iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6; on Red Hat Enterprise Linux (including AUS/ELS) install Red Hat's updated WebKitGTK/WPE WebKit packages. Organizations subject to CISA BOD 22-01 must patch or mitigate by the April 3, 2026 deadline. Until patched, restrict WebKit-based browsing and webviews on affected devices to trusted content, since exploitation requires loading maliciously crafted web content.

Craft CMS contains a code injection vulnerability (CWE-94) that allows a remote attacker to execute arbitrary code on affected servers. CISA's listing does not specify the exact attack path or authentication requirements, but the flaw is remotely triggerable and grants arbitrary code execution, which typically means full compromise of the web server and a foothold for follow-on activity such as ransomware (ransomware use is not yet confirmed). Any organization running a Craft CMS instance is in scope, including internet-facing content sites and deployments where the Craft admin panel is reachable from the internet. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20, confirming exploitation in the wild, and EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is known. No CVSS score has been published yet, so defenders should treat the flaw as urgent given the KEV listing and near-certain EPSS likelihood.

Do: Apply the patched Craft CMS release per the vendor's security advisory referenced in CISA's KEV entry (specific fixed version numbers are not provided in the source data), prioritizing internet-exposed instances, and U.S. federal agencies should follow BOD 22-01 requirements for KEV-listed flaws. Until patched, restrict network access to the Craft CMS control panel/admin interface and review web and application logs for signs of code injection or unexpected process execution, since exploitation in the wild is confirmed while ransomware use remains unknown. Given the 99.8% EPSS score and KEV listing, treat discovery and patching of all Craft CMS instances, including headless deployments, as an urgent, time-boxed task.

CVE-2025-43510 is an improper locking flaw (CWE-667) in Apple's operating systems that leads to memory corruption, addressed by improved lock state checking. It is triggered locally: a malicious application already running on the device can cause unexpected changes in memory shared between processes, with the CVSS vector (AV:L, UI:R) indicating user interaction is required but no privileges needed beforehand. Successful exploitation could corrupt or expose cross-process shared memory, yielding high impacts on confidentiality, integrity, and availability (CVSS 3.1 score 7.8), and such shared-memory corruption bugs in Apple's OSes are commonly leveraged as steps in chained attacks such as sandbox escapes. All users of iOS, iPadOS, macOS (Sonoma, Sequoia, and Tahoe branches), tvOS, visionOS, and watchOS on versions earlier than the fixed releases are affected. The vulnerability is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-20 with a federal patching deadline of April 3, 2026, and news reports describe an active iOS exploit kit ('DarkSword') using multiple Apple flaws, including zero-days, in global attacks.

Do: Update to the fixed releases: iOS/iPadOS 18.7.2 or iOS/iPadOS 26.1; macOS Sonoma 14.8.2, Sequoia 15.7.2, or Tahoe 26.1; tvOS 26.1; visionOS 26.1; and watchOS 26.1. As a local attack vector, prioritize patching devices that install untrusted apps, and federal agencies must apply the fixes under BOD 22-01 by April 3, 2026 per the CISA KEV listing. Given reports of the DarkSword iOS exploit kit chaining multiple Apple flaws in active attacks, treat unpatched iPhones and iPads as high priority and verify OS versions across your fleet.

CVE-2025-54068 is an improper hydration flaw (CWE-94 code injection) in Livewire v3, a full-stack framework for Laravel, that allows unauthenticated attackers to achieve remote command execution in specific scenarios. The flaw is triggered when a Livewire component is mounted and configured in a particular way and receives certain component property updates, with no authentication or user interaction required. A successful attacker gains code execution on the server hosting the affected Laravel application. Only Livewire v3 up to and including v3.6.3 is affected; earlier major versions are not impacted, and the issue is fixed in v3.6.4. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2026-03-20, patching deadline 2026-04-03), indicating confirmed exploitation in the wild, and EPSS assigns a 96.5% probability of exploitation within 30 days.

Do: Upgrade Livewire to v3.6.4 or later immediately, as no workarounds are available. Audit Laravel applications for Livewire v3 usage and identify components mounted and configured in the vulnerable property-hydration pattern, prioritizing internet-facing apps. Federal agencies must apply vendor mitigations or discontinue use by the BOD 22-01 deadline of April 3, 2026.