Spyware industry updates: Patch Tuesday highlights.

Recent news in the cybersecurity industry highlights the use of spyware by various governments to target journalists and activists. For instance, a report from the University of Toronto’s Citizen Lab sheds light on the Italian government’s utilization of Paragon’s Graphite spyware on individuals like activists Luca Casarini and Dr. Giuseppe Caccia, as well as journalist Francesco Cancellato. Following this revelation, Paragon, an Israel-based company, terminated its contract with Italy after being denied the opportunity to investigate the targeting of Cancellato.

This report also marks the first forensic confirmation of Graphite’s use against iOS devices, employing a zero-click attack that exploited a logic issue in processing a maliciously crafted photo or video through an iCloud Link. This vulnerability, identified as CVE-2025-43200, was patched by Apple in iOS 18.3.1. Meanwhile, Intellexa’s Predator spyware has found a new customer in the Mozambique government, adding to a list of users in several African countries and further complicating the already shady network of Intellexa entities.

Moving on to the latest Patch Tuesday updates, Microsoft addressed 67 Windows vulnerabilities, including a zero-day affecting Web Distributed Authoring and Versioning (WebDAV) implementation in Windows that can lead to remote code execution. Also, Adobe released patches for 259 vulnerabilities in various products, with Google and Mozilla updating their browsers to address high-severity issues.

In response to a ransomware attack that caused blood donor shortages following a July 2024 incident against Synnovis, the UK’s National Health Service (NHS) has issued an urgent call for one million blood donors to address the pressing need for O-negative donors and those of Black heritage with the Ro blood subtype. The cyberattack disrupted pathology services in London, leading hospitals to rely on universal O-negative blood for transfusions as blood matching tests were unavailable.

Moreover, United Natural Foods, a prominent wholesale food distributor in North America, disclosed a cyberattack that occurred on June 5th, impacting its operational ability to fulfill customer orders. The company is actively working with cybersecurity professionals and law enforcement to assess and mitigate the incident, implementing business continuity plans to continue servicing customers where possible amid temporary disruptions.

Lastly, President Trump recently signed an Executive Order amending cybersecurity policies introduced during the Obama and Biden administrations, underscoring the evolving landscape of cybersecurity practices in response to emerging threats and challenges.