High net worth individuals in crypto are currently being targeted because of a Zero-Day exploit in the apple ecosystem

If anyone sends you a picture (iOS or macOS), they can drain your wallets.

Update to the newest iOS and macOS versions immediately.

Logged as CVE-2025-43300, the bug is an out-of-bounds write issue in ImageIO, the component apps rely on to read and write standard image formats. Apple warned that the flaw could let miscreants hijack devices with a booby-trapped image – and for some iDevice users, it sounds like the damage has already been done.

btw iOS exploits are crazy hard and require like 10+ vulnerabilities together sometimes.

source

somehow reminds me of a 2021 exploit:

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1

Sorry about that, one of our developers tried to escape from our dungeons, it took us a bit of time lock-in him back to fix it. New chains are now in place to prevent it in the future 😊

The ability to add music to your profile.

@telelakel

the future is bright

Comet AI browser can get prompt injected from any site, drain your bank account
Article, Comments

Google will begin verifying the identity of ALL DEVELOPERS who distribute apps on Android, even if it's outside the Play Store!

This is to prevent malware developers from using anonymity as a shield.

🔗https://www.androidauthority.com/android-developer-verification-requirements-3590911/

Google says that hobbyist & student devs will NOT have to pay the $25 registration fee.

Also, any info you provide won't be shown to Android users, unlike on Google Play.

profileTabGifts#4d4bd46a = ProfileTab;
profileTabMedia#72c64955 = ProfileTab;
profileTabMusic#9f27d26e = ProfileTab;
profileTabGifs#a2c0f695 = ProfileTab;
profileTabFiles#ab339c00 = ProfileTab;
profileTabPosts#b98cd696 = ProfileTab;
profileTabLinks#d3656499 = ProfileTab;
profileTabVoice#e477092e = ProfileTab;

channels.setMainProfileTab#3583fcb1 channel:InputChannel tab:ProfileTab = Bool;

> Layer 213

Grok 2.5 is now open source. Grok 3 will be open source in about 6 months

https://huggingface.co/xai-org/grok-2

- hn post
- twitter post

PoC for those who are interested:

https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md

Prompt:

change the ambience to an apocalyptic scene

Model: Gemini 2.5 Flash
Used image references

Spotify.

telegram added spotify
so spotify added telegram

job description redflags

CVE-2025-24893: (severity: 9.8/10)

XWiki Remote code execution as guest via SolrSearchMacros request.
Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation.

This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.

- PoC (python)
- GitHub Advisory Database
- Template Source
- Macros.vm source
- patch commit

Weakness Enumeration:
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

#cve #vulnerability #java

lets say a simple min-max prediction model has lots of parameters in it, leading to mostly data-snooping.
do you think in such a model, we can solve the data-snooping bias by adding millions of patterns with complex parameters, so it can cover more strict cases but also somehow DOES detect patterns?

never gets old