Microsoft rated this bug as low exploitability. Miscreants weaponized it in just 8 days

On March 11 - Patch Tuesday - Microsoft rolled out its usual buffet of bug fixes. Just eight days later, miscreants had weaponized one of the vulnerabilities, using it against government and private sector targets in Poland and Romania. The Windows flaw in question was CVE-2025-24054, an NTLM hash-leaking vulnerability that Microsoft rated as "less likely" to be exploited. Attackers begged to differ and built malware that abused the bug, according to researchers at Check Point. Last Wednesday, Apple pushed out iOS 18.4.1 and iPadOS 18.4.1 to patch two zero-day vulnerabilities that it says were exploited in "extremely sophisticated" attacks against targeted individuals. The first fix addresses a memory corruption issue in CoreAudio, which processes audio streams. Apple and Google's Threat Analysis Group jointly reported the bug, which could lead to arbitrary code execution when handling a maliciously crafted media file. The second patch addresses a flaw in the Return Pointer Authentication Code (RPAC), part of Apple's mechanism for blocking pointer manipulation attacks. According to Cupertino, an attacker with arbitrary read and write access "may be able to bypass Pointer Authentication." Apple mitigated the issue by removing the vulnerable code. Specifically, the vulnerability can be exploited to leak a victim's Net-NTLMv2 or NTLMv2-SSP hash over the network. According to Check Point, miscreants can "attempt to brute-force the hash offline or perform relay attacks," and imper...