WhatsApp has acknowledged that a flaw in its system “may have been exploited in a sophisticated attack against specific targeted users.”

The warning came last week in a security advisory from Meta, which disclosed vulnerability CVE-2025-55177. The company said the flaw involved “incomplete authorization of linked device synchronization messages in WhatsApp,” potentially allowing an unrelated user to force the processing of content from an arbitrary URL on a victim’s device.

Meta’s security team also referenced the zero-click flaw Apple recently patched — CVE-2025-43300 — noting that both vulnerabilities “may have been exploited in a sophisticated attack against specific targeted users.”

Donncha Ó Cearbhaill, who leads Amnesty International’s Security Lab, suggested the flaws were likely used in highly specialized attacks. Past cases, he said, indicate such methods are often deployed by commercial surveillanceware vendors against carefully selected individuals.

Although surveillance software is officially intended for use against criminals, it has also been used to target journalists, human rights defenders, and others viewed as adversaries by certain governments.

With WhatsApp offering a $1 million bounty for the discovery of zero-click vulnerabilities, experts say the reward may well reflect the value attackers place on such flaws.

Meanwhile, Microsoft has announced that multi-factor authentication (MFA) will soon be mandatory for Azure systems. From 1 October, all accounts performing Create, Update, or Delete operations via Azure CLI, PowerShell, the Azure mobile app, IaC tools, or REST API endpoints will require MFA. Only read-only operations will be exempt.

Microsoft noted that organisations facing “complex environments or technical barriers” could request an extension until 1 July next year. It also recommended migrating user-based service accounts in Microsoft Entra ID to secure, cloud-based accounts with workload identities.

Cybersecurity experts have long argued that MFA should be standard across all Azure accounts, pointing to its strong record in reducing the risk of hacking attempts.

Source: The Register

Total views: 823