Do Son CISA adds 5 actively exploited flaws to its KEV catalog, including a critical 10.0 CVSS Craft CMS bug and Apple zero-days linked to DarkSword malware.
CVE-2025-32432
Mimo (Hezb) is exploiting an unauthenticated RCE (CVE-2025-32432) in Craft CMS to deploy webshells, cryptominers, and proxyware. Patch now!
Critical Craft CMS zero-day CVE-2025-32432 exploited with Yii flaw; Metasploit module published, urging urgent patching to prevent server breaches.
Craft CMS patches critical CVE-2025-32432 flaw. Exploited in the wild—users must update to versions 3.9.15, 4.14.15, or 5.6.17.