WhatsApp Emergency Update Patches Zero-Day Spyware Flaw on iOS, macOS

WhatsApp released an emergency update to patch zero-day vulnerability CVE-2025-55177, enabling zero-click spyware exploits on iOS and macOS via linked Apple flaw CVE-2025-43300. Targeted at journalists and activists, it highlights escalating cyber threats. Users must update immediately for protection.
WhatsApp Emergency Update Patches Zero-Day Spyware Flaw on iOS, macOS
Written by Emma Rogers

In a swift response to a sophisticated cyber threat, WhatsApp has rolled out an emergency update to patch a critical zero-day vulnerability that allowed attackers to compromise iOS and macOS devices without any user interaction. The flaw, identified as CVE-2025-55177, was linked to another zero-day in Apple’s ecosystem, CVE-2025-43300, and has been exploited in targeted spyware campaigns, according to reports from cybersecurity experts.

The vulnerability enabled so-called zero-click exploits, where malicious code could be injected simply by sending a specially crafted message or image, bypassing traditional security measures. This type of attack is particularly insidious because it requires no action from the victim, such as clicking a link or opening a file, making it a favored tool for state-sponsored hackers and surveillance firms.

The Rising Tide of Zero-Click Threats in Messaging Apps

Details emerging from The Hacker News indicate that the exploit was discovered after reports of unusual app behavior on affected devices, prompting Meta, WhatsApp’s parent company, to investigate. The patch was deployed rapidly, underscoring the urgency as evidence pointed to active exploitation against high-profile targets like journalists and activists.

Apple, in coordination, issued its own updates to address the interconnected flaw in its ImageIO framework, which processes images and could be manipulated to execute arbitrary code. This collaboration highlights the intertwined nature of app and operating system security, where a weakness in one can cascade into broader risks.

Links to Broader Spyware Campaigns and Historical Precedents

Investigations suggest this incident echoes previous spyware operations, such as a zero-click campaign disrupted by Meta earlier this year, which targeted 90 journalists and activists using tools from firms like Paragon Solutions, as detailed in another The Hacker News report. Such attacks often leverage advanced persistent threats, where attackers maintain long-term access to harvest data or monitor communications.

The timing of WhatsApp’s update coincides with heightened scrutiny on messaging platforms. For instance, the U.S. House recently banned WhatsApp on official devices citing security and data protection concerns, recommending alternatives like Signal, per coverage from The Hacker News. This reflects growing institutional wariness amid escalating cyber espionage.

Implications for Users and the Tech Industry’s Response

For industry insiders, this vulnerability raises questions about the efficacy of end-to-end encryption in apps like WhatsApp when zero-days can circumvent it at the device level. Experts advise immediate updates to the latest versions—WhatsApp 2.25.80 for iOS and macOS—to mitigate risks, emphasizing that even encrypted platforms are only as secure as their underlying software.

Broader patterns show a surge in such exploits; just weeks ago, Apple patched a similar zero-day in its ImageIO framework under active attack, as reported by SiliconANGLE. Meanwhile, unrelated but timely incidents, like the hacking of Kerala Disaster Management Authority’s WhatsApp groups disrupting emergency communications, per ETV Bharat, illustrate how vulnerabilities can have real-world consequences beyond individual privacy.

Strategic Shifts in Cybersecurity Priorities

As threats evolve, companies like Meta are enhancing features like advanced chat privacy controls, which block exports and auto-downloads to bolster user defenses, according to The Hacker News. Yet, the persistence of zero-days suggests a need for proactive threat hunting and international cooperation to counter spyware proliferation.

Ultimately, this episode serves as a stark reminder for tech leaders: in an era of interconnected devices, securing messaging apps demands vigilance across the entire ecosystem, from code audits to rapid patching protocols, to safeguard against increasingly covert digital intrusions.

Subscribe for Updates

AppDevNews Newsletter

The AppDevNews Email Newsletter keeps you up to speed on the latest in application development. Perfect for developers, engineers, and tech leaders.

By signing up for our newsletter you agree to receive content related to ientry.com / webpronews.com and our affiliate partners. For additional information refer to our terms of service.

Notice an error?

Help us improve our content by reporting any issues you find.

Get the WebProNews newsletter delivered to your inbox

Get the free daily newsletter read by decision makers

Subscribe
Advertise with Us

Ready to get started?

Get our media kit

Advertise with Us