[tomek@vz]

WhatsApp said on Friday that it fixed a security bug in its iOS and Mac apps that was being used to stealthily hack into the Apple devices of "specific targeted users." The Meta-owned messaging app giant said in its security advisory that it fixed the vulnerability, known officially as CVE-2025-55177, which was used alongside a separate flaw found in iOS and Macs, which Apple fixed last week and tracks as CVE-2025-43300.

Apple said at the time that the flaw was used in an "extremely sophisticated attack against specific targeted individuals." Now we know that dozens of WhatsApp users were targeted with this pair of flaws. Donncha O Cearbhaill, who heads Amnesty International's Security Lab, described the attack in a post on X as an "advanced spyware campaign" that targeted users over the past 90 days, or since the end of May. O Cearbhaill described the pair of bugs as a "zero-click" attack, meaning it does not require any interaction from the victim, such as clicking a link, to compromise their device.

The two bugs chained together allow an attacker to deliver a malicious exploit through WhatsApp that's capable of stealing data from the user's Apple device. Per O Cearbhaill, who posted a copy of the threat notification that WhatsApp sent to affected users, the attack was able to "compromise your device and the data it contains, including messages." It's not immediately clear who, or which spyware vendor, is behind the attacks. When reached by TechCrunch, Meta spokesperson Margarita Franklin confirmed the company detected and patched the flaw "a few weeks ago" and that the company sent "less than 200" notifications to affected WhatsApp users. The spokesperson did not say, when asked, if WhatsApp has evidence to attribute the hacks to a specific attacker or surveillance vendor.

--------------------------------------------------------

Defense Secretary Pete Hegseth said the Pentagon has halted a decade-old Microsoft program that has allowed Chinese coders, remotely supervised by U.S. contractors, to work on sensitive DOD cloud systems. In a digital video address to the public posted yesterday, the secretary said DOD was made aware of the "digital escorts" program last month and that the program has exposed the Defense Department to unacceptable risk -- despite being designed to comply with government contracting rules.

"If you're thinking 'America first,' and common sense, this doesn't pass either of those tests," Hegseth said, adding that he initiated an immediate review of the program upon learning of it. "I want to report our initial findings. ... The use of Chinese nationals to service Department of Defense cloud environments? It's over," he said. Additionally, Hegseth said DOD has issued a formal letter of concern to Microsoft, documenting a breach of trust, and that DOD is requiring a third-party audit of the digital escorts program to pore over the code and submissions made by Chinese nationals. The audit will be free of charge to U.S. taxpayers, he said.

-------------------------------------------------------

US states are imposing stricter rules on how tech companies collect, analyze, and monetize biometric data, including facial features, iris patterns, and other unique identifiers. While no federal regulation currently governs facial recognition systems, the National Conference of State Legislatures reports that 23 states have passed or updated laws to limit the mass collection of biometric information.

> Techspot


Pitam se kad ce i kod nas (razina EU) ovo implementirati - prijavu kroz Fingerprint reader na lapu su odavno iskljucili.