CVE

CVE-2025-43529

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also

Exploitation IoCs 15

Domain cloudfareintcdn[.]com

Domain funnull-hosted

Package chilltvcms/theme-legend

Package haiau009/kkphim-legend

Package haiau009/kkphim-motchill

Package ophimcms/theme-dy

Package ophimcms/theme-motchill

Package ophimcms/theme-pcc

Package ophimcms/theme-rrdyw

Package vsmov/theme-dy

Package vsmov/theme-motchill

Package vsmov/theme-rrdyw

Package vsmov/theme-vsmov

Package vsphim/theme-heovl

Package vsphim/theme-thempho

MITRE ATT&CK TTPs 6

T1003

OS Credential Dumping

Source Articles

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Security researchers have uncovered 13 malicious Packagist packages distributed under five vendor namespaces that target unpatched iOS devices through compromised Vietnamese movie and comic streaming sites. The packages inject JavaScript to conduct ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain on iPhones to install spyware. The exploit chain leverages CVE-2025-31277 and CVE-2025-43529, ultimately achieving kernel-level access to steal sensitive data including keychain databases, Wi-Fi passwords, SMS, photos, and cryptocurrency wallet seeds from popular wallets like Trust Wallet and Phantom. The stolen data is encrypted with AES and exfiltrated to command and control domains, with exploitation progress beaconed to cloudfareintcdn[.]com.

hacker-news Sep 1, 2026