CISA warns of Apple zero-day used in targeted cyberattacks

A zero-click vulnerability in Apple’s ImageIO (CVE-2025-43300, severity 8.8) is being exploited in the wild to target specific individuals; CISA issued a directive requiring federal agencies to patch and Apple released fixes. The exploit is triggered by processing maliciously crafted images delivered via messages, email, or web content and is associated with sophisticated spyware actors and prior ImageIO exploit chains.