June 2025: [WebDAV Attacks, SSH Hijacks, and macOS Sandbox Escapes]

CVE-2025-26466 is a denial-of-service flaw that lets a malicious client exhaust an SSH server's memory by flooding it with ping messages. After that exhaustion, CVE-2025-26465 allows a host key verification skip when VerifyHostKeyDNS is enabled, chaining into a man-in-the-middle SSH session hijack.

Mitigate the SSH pair by updating off OpenSSH 9.9p1 or earlier, and if patching has to wait, disable the VerifyHostKeyDNS option and tune LoginGraceTime and MaxStartups to blunt the denial-of-service risk.

Mat Lee's rule of thumb: SSH should never be open to the internet, and Automox audits AWS for port 22 exposed to 0.0.0.0/0 and works to auto-remediate it.

CVE-2025-33053 is a WebDAV remote code execution flaw exploited in the wild that uses path injection. An attacker PUTs an executable payload, then renames it with a separator like a semicolon to invoke an interpreter. They trigger it via a crafted URL and DELETE the file afterward to clean up.

On macOS Sequoia 15.5, CVE-2025-31244 lets an app escape the macOS quarantine sandbox, which the team flagged as chainable with a service elevation of privilege flaw and an iCloud Keychain bug that exposes stored usernames and websites, though not passwords.