AtRisk September 18, 2025 Vol. XXV

Jump to:

Internet Storm Center Spotlight
Recent CVEs
Sponsors
Read More

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Apple Updates Everything - iOS/macOS 26 Edition

Published: 2025-09-15

Last Updated: 2025-09-15 21:17:32 UTC

by Johannes Ullrich (Version: 1)

Today, as expected, Apple released iOS/iPadOS/macOS/watchOS/tvOS 26. Going forward, Apple will adopt the same OS number across its different offerings, setting us up for a potential year 2100 issue. Notably, VisionOS was not updated.

There are two options to apply the security updates: You may stick with the old major operating system version (iOS 18 or macOS 15), or you may upgrade directly to the "26" version. For more careful users, sticking with the older version will get you all the security fixes (and other bug fixes), but none of the new features and the potential instabilities and compatibility issues.

This update also includes a patch for an already-exploited vulnerability, CVE-2025-43300. Apple patched this vulnerability in August, but only for current operating systems. This update backports this patch for older versions of iOS.

I did some quick Google searches if OS 26 supports various popular security software. Here is a quick summary:

Crowdstrike: Falcon >= 7.29
Little Snitch >= 6.3
Microsoft Defender: supported (July 1st)
Palo Alto Networks GlobalProtect: "appears to work, firewall detection does not work on macOS 26" (reddit user report, 3 months ago)
1Password works fine
ssh, included with macOS, uses OpenSSH 10.0p2 vs 9.9p2. The newer version of OpenSSH no longer supports some weaker key exchanges, leading to possible issues accessing legacy equipment

Let me know if you have any firsthand experience with any security-related applications that either work or do not work.

Read the full entry: https://isc.sans.edu/diary/Apple+Updates+Everything+iOSmacOS+26+Edition/32286/

Why You Need Phishing Resistant Authentication NOW.

Published: 2025-09-16

Last Updated: 2025-09-16 18:04:16 UTC

by Johannes Ullrich (Version: 1)

The recent (and still ongoing) phishing of NPM developer accounts showed yet again that even technically sophisticated and aware users are falling for phishing lures. Anybody will fall for phishing if a well-targeted e-mail is used.

All it took for the NPM phish to succeed was a well-written email and a convincing landing page. This case used "npmjs[.]help", but a few days later, someone also registered "npmjs[.]cam" (the TLD is .CAM, not .COM, a somewhat underused phishing trick).

Luckily, npmjs[.]cam is currently not reachable ...

Read the full entry: https://isc.sans.edu/diary/Why+You+Need+Phishing+Resistant+Authentication+NOW/32290/

BASE64 Over DNS

Published: 2025-09-10

Last Updated: 2025-09-10 14:55:07 UTC

by Didier Stevens (Version: 1)

On the Stormcast, Johannes talked about BASE64 and DNS used by a backdoor.

I was interested to learn more about this, because DNS labels can only contain letters, digits and a hyphen. If you make a distinction between uppercase and lowercase letters, you have exactly 63 characters to choose from. While BASE64 requires 64 characters (and a 65th character for padding: =).

So how can the backdoor use BASE64 in a label, since RFC 1035 (and updates) does not allow characters +, / and = ?

I did some tests ...

Read the full entry: https://isc.sans.edu/diary/BASE64+Over+DNS/32274/

CTRL-Z DLL Hooking (2025.09.17)

https://isc.sans.edu/diary/CTRLZ+DLL+Hooking/32294/

Web Searches For Archives (2025.09.14)

https://isc.sans.edu/diary/Web+Searches+For+Archives/32282/

DShield SIEM Docker Updates (2025.090.10)

https://isc.sans.edu/diary/DShield+SIEM+Docker+Updates/32276/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2025-10159 - Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7) are vulnerable to an authentication bypass issue that enables remote attackers to achieve administrative privileges.

Product: Sophos AP6 Series Wireless Access Points

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10159

ISC Podcast: https://isc.sans.edu/podcastdetail/9608

NVD References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20250909-ap6

CVE-2025-43300 - macOS, iPadOS, iOS, and iPadOS were all vulnerable to an out-of-bounds write issue that could be exploited through a malicious image file, leading to memory corruption and potentially targeted attacks.