⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More

According to The Hacker News, the weekly recap highlights that Apple and Google have released fixes for two actively exploited zero-days, CVE-2025-14174 and CVE-2025-43529, with Apple noting a memory corruption issue and a use-after-free bug that can be triggered by malicious web content.

The piece also reports that the WinRAR vulnerability CVE-2025-6218 is under active exploitation by three threat actors tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon, with CISA adding the flaw to its KEV catalog and mandating fixes for FCEB agencies by 30 December 2025.

In the UK, the ICO fined LastPass’s British subsidiary £1.2 million for a 2022 breach that exposed customer data, including encrypted password vaults, after attackers leveraged a developer MacBook Pro and a Plex vulnerability to access the environment. The roundup also mentions APT-C-60 targeting Japan to deliver SpyGlace via spear-phishing, with recent activity observed between June and August 2025.