Threat awareness

Threat awarenessEXPLAINER · 6 MIN READ

When a spreadsheet’s data connection becomes permission to run code

New LibreOffice and Apache OpenOffice disclosures expose a dangerous gap between reading spreadsheet data and running software. The two suites require different responses.

Threat awarenessEXPLAINER · 6 MIN READ

The Apple flaw hiding between a letter’s outline and its pixels

A document preview has to turn shapes into pixels. Apple’s rendering flaw shows how a mistake in that ordinary work can cross a memory boundary—and why the operating system needs the repair.

Threat awarenessEXPLAINER · 6 MIN READ

A trusted software release can still betray the developer installing it

Tensorlake’s compromised npm release came through the project’s own publishing process. Following it from source code to installation reveals what origin checks can establish and where a developer’s computer can become exposed.

Threat awarenessEXPLAINER · 6 MIN READ

An optional monitoring feature put Zimbra’s mail servers at risk

The Zimbra intrusion route ran through an optional monitoring component. That small feature could expose a much larger mail service, leaving administrators to examine messages, service credentials and the period before patching.

Threat awarenessEXPLAINER · 5 MIN READ

WhatsApp and ImageIO: why the 2025 exploit pairing needed two patches

An authorization flaw in WhatsApp and a memory-safety flaw in Apple’s ImageIO had different fixes. The case shows why app updates and OS updates need separate verification.

Threat awarenessEXPLAINER · 4 MIN READ

LANDFALL: the Samsung codec bug behind a targeted spyware campaign

Unit 42 linked recovered spyware samples to a Samsung image-decoding flaw. The report also leaves gaps in the delivery and privilege-escalation chain that should not be filled with assumptions.

Threat awarenessEXPLAINER · 5 MIN READ

DarkSword: six CVEs across several layers of iOS

The public reports connect JavaScript, graphics, shared-memory and kernel flaws. Understanding the kit also requires separating its payloads and following Apple’s later backports.

Threat awarenessEXPLAINER · 4 MIN READ

Inside Coruna: how an iOS exploit kit covered several software generations

Google reported five alternative iOS chains containing 23 exploits. Their version coverage, reuse and patch history explain why a small group of outdated devices can still matter.

Threat awarenessEXPLAINER · 4 MIN READ

Android CVE-2025-48633: when the advisory label and description disagree

Google’s record labels this flaw information disclosure but describes adding a Device Owner after provisioning. Keeping both parts visible changes what a device-management review needs to check.