The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert about a critical vulnerability in multiple Apple products.

Tracked as CVE-2022-48503, this unspecified issue in the JavaScriptCore engine could allow attackers to execute arbitrary code simply by processing malicious web content. The flaw affects macOS, iOS, tvOS, Safari, and watchOS, putting millions of users at risk of remote exploitation.

First disclosed in 2022, the vulnerability has resurfaced in active attacks, according to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Security researchers note that while Apple patched it in subsequent updates, unpatched or end-of-life (EoL) systems remain prime targets.

“This isn’t just a relic of the past threat actors are weaponizing old bugs against outdated devices,” said a CISA spokesperson in the advisory.

The agency emphasized that the vulnerability’s severity stems from its potential for full system compromise, enabling data theft, ransomware deployment, or further malware spread.

Although no direct ties to ransomware campaigns have been confirmed, the unknown exploitation history underscores the urgency for immediate action.

Widespread Impact on Apple’s Ecosystem

The vulnerability’s broad reach spans Apple’s core operating systems and browser. JavaScriptCore, the engine powering Safari and other web rendering in iOS, macOS, tvOS, and watchOS, processes dynamic web elements like scripts and animations.

An attacker could craft a booby-trapped webpage or email link to trigger the flaw, bypassing traditional defenses. Older devices, such as those running iOS 15 or earlier macOS versions, are particularly vulnerable if they haven’t received updates.

CISA warns that end-of-service (EoS) products no longer supported by Apple offer no patch path, leaving users exposed indefinitely.

For cloud-integrated services, CISA references Binding Operational Directive (BOD) 22-01, urging federal agencies and critical infrastructure operators to apply mitigations or retire affected systems.

Private users face similar risks, especially in hybrid work environments where personal Apple devices handle sensitive data.

CISA’s directive is clear: Update to the latest vendor-patched versions immediately. Apple released fixes in security updates dating back to early 2023, but users must verify their systems via Settings > General > Software Update.

If mitigations aren’t feasible, particularly for EoL hardware, the agency advises discontinuing use to avoid exploitation. Network defenders should monitor for anomalous JavaScript activity and enforce endpoint detection rules targeting code execution attempts.

Recent reports indicate that attacks on Apple platforms are surging by 20% year over year, making staying vigilant non-negotiable. Organizations delaying patches risk cascading breaches, while individuals should prioritize updates to safeguard their digital lives.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post CISA Warns of Apple macOS, iOS, tvOS, Safari, and watchOS Vulnerability Exploited in Attacks appeared first on Cyber Security News.

A severe vulnerability in the popular better-auth library’s API keys plugin enables attackers to generate privileged credentials for any user without authentication.

Dubbed CVE-2025-61928, the issue affects better-auth, a TypeScript authentication framework downloaded around 300,000 times weekly on npm.

This flaw could lead to widespread account compromises, particularly for applications relying on API keys for automated access. Better-auth powers authentication for fast-growing startups and major enterprises, including energy giant Equinor.

Its plugin architecture simplifies adding features like API key management, but a subtle bug in the authorization logic opened the door to exploitation.

ZeroPath uncovered the vulnerability during scans of third-party dependencies, highlighting risks in authentication libraries that underpin entire application ecosystems.

Better Auth API Keys Vulnerability

The problem lies in the createApiKey handler within the plugin. Normally, it derives user context from an active session to enforce security checks.

However, when a request lacks a session but includes a userId in the body, the code sets an “authRequired” flag to false. This skips critical validations, allowing the handler to fabricate a user object from attacker-supplied data.

As a result, unauthenticated attackers can POST to the /api/auth/api-key/create endpoint with a target user’s ID, name, and optional privileged fields like rate limits or permissions.

The response returns a valid API key tied to the victim’s account, bypassing multi-factor authentication and enabling scripted takeovers. The same logic affects update endpoints, amplifying the risk.

API keys often grant long-lived, elevated privileges for automation, making this vulnerability particularly dangerous. Attackers could impersonate users, access sensitive data, or automate malicious actions across services.

Only deployments with the API keys plugin are impacted, but given better-auth’s adoption, exposure is significant. To mitigate, upgrade immediately to better-auth version 1.3.26 or later, which fixes the authorization check.

Rotate all API keys created via the plugin, invalidate unused ones, and audit logs for suspicious unauthenticated requests to create or update endpoints, especially those setting userId or high-privilege values.

The maintainers patched it swiftly after disclosure on October 2. The advisory (GHSA-99h5-pjcv-gr6v) was published on October 8 via GitHub, and the CVE was assigned the next day.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Better Auth API keys Vulnerability Let Attackers Create Privileged Credentials For Arbitrary Users appeared first on Cyber Security News.

A sophisticated vulnerability in Microsoft 365 Copilot (M365 Copilot) that allows attackers to steal sensitive tenant data, including recent emails, through indirect prompt injection attacks.

The flaw, detailed in a blog post published today by researcher Adam Logue, exploits the AI assistant’s integration with Office documents and its built-in support for Mermaid diagrams, enabling data exfiltration without direct user interaction beyond an initial click.

The attack begins when a user asks M365 Copilot to summarize a maliciously crafted Excel spreadsheet. Hidden instructions, embedded in white text across multiple sheets, use progressive task modification and nested commands to hijack the AI’s behavior.

These indirect prompts override the summarization task, directing Copilot to invoke its search_enterprise_emails tool to retrieve recent corporate emails. The fetched content is then hex-encoded and fragmented into short lines to bypass Mermaid’s character limits.

Microsoft 365 Copilot Data Exfiltration Via Deceptive Diagrams

Copilot generates a Mermaid diagram, a JavaScript-based tool for creating flowcharts and charts from Markdown-like text that masquerades as a “login button” secured with a lock emoji.

The diagram includes CSS styling for a convincing button appearance and a hyperlink embedding the encoded email data.

When the user clicks it, believing it’s needed to access the document’s “sensitive” content, the link directs to the attacker’s server, such as a Burp Collaborator instance. The hex-encoded payload transmits silently, where it can be decoded from server logs.

Mermaid’s flexibility, including CSS support for hyperlinks, made this vector particularly insidious. Unlike direct prompt injection, where attackers converse with the AI, this method hides commands in benign files like emails or PDFs, making it stealthy for phishing campaigns.

Adam Logue noted similarities to a prior Mermaid exploit in Cursor IDE, which enabled zero-click exfiltration via remote images, though M365 Copilot required user interaction.

The payload, after extensive testing, was inspired by Microsoft’s TaskTracker research on detecting “task drift” in LLMs. Despite initial challenges reproducing the issue, Microsoft validated the chain and patched it by September 2025, removing interactive hyperlinks from Copilot’s rendered Mermaid diagrams.

The discovery timeline shows that there were challenges in coordination. Adam Logue reported the complete situation on August 15, 2025, after discussions with the Microsoft Security Response Center (MSRC) staff at DEFCON.

After iterations, including video proofs, MSRC confirmed the vulnerability on September 8 and resolved it by September 26. However, M365 Copilot fell outside the bounty scope, denying a reward.

This incident underscores risks in AI tool integrations, especially for enterprise environments handling sensitive data. As LLMs like Copilot connect to APIs and internal resources, defenses against indirect injections remain critical.

Microsoft emphasized ongoing mitigations, but experts urge users to verify document sources and monitor AI outputs closely.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Microsoft 365 Copilot Prompt Injection Vulnerability Allows Attackers to Exfiltrate Sensitive Data appeared first on Cyber Security News.