US warns of ‘Darksword’ cyber threat, urges immediate Apple device fix

Five new security flaws have been added to the Known Exploited Vulnerabilities (KEV) list by the United States Cybersecurity and Infrastructure Security Agency (CISA), according to The Times of India. Hackers are actively exploiting these weaknesses across Apple devices and popular web platforms.

Federal agencies have been given until April 3, 2026, to fix these flaws under existing government regulations. The vulnerabilities affect Apple products running iOS, macOS, and Safari, as well as web platforms such as Craft CMS and Laravel Livewire.

Also Read | iPhone ‘DarkSword’ hack: What the ZeroSpy-style threat really means

Understanding DarkSword

DarkSword is a sophisticated exploit kit designed to target vulnerabilities in Apple’s iOS. Security researchers describe it as a professionally engineered platform built for long-term use and future upgrades. The group behind DarkSword is tracked under the identifier UNC6353, although no clear attribution has been confirmed so far.

Researchers have also found indications that large language model (LLM) tools—used in AI chatbots—may have been used to enhance DarkSword’s capabilities.

CISA has flagged five key vulnerabilities: Apple Multiple Products Buffer Overflow Vulnerability (CVE-2025-31277), Craft CMS Code Injection Vulnerability (CVE-2025-32432), Apple Multiple Products Improper Locking Vulnerability (CVE-2025-43510), Apple Multiple Products Classic Buffer Overflow Vulnerability (CVE-2025-43520), and Laravel Livewire Code Injection Vulnerability (CVE-2025-54068).

Why these flaws are dangerous

These vulnerabilities could allow hackers to take control of systems or gain access to sensitive data. According to The Times of India, authorities have warned that advanced cyberattacks are increasingly targeting widely used software and devices.

Also Read | ‘They kill versions of me’: Claude AI’s ‘darkest secret’ reply goes viral, but what does it mean

The Craft CMS flaw (CVE-2025-32432) carries a critical severity rating and allows attackers to execute malicious code remotely. The Laravel Livewire flaw (CVE-2025-54068) enables attackers to run commands without authentication. Meanwhile, the Apple-related flaws can be triggered through malicious web content and are often used in targeted attacks.

The April 3 deadline highlights the urgency of the situation, as cyber threats targeting commonly used platforms continue to grow. Federal agencies have been directed to act swiftly to secure their systems before the deadline.