Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The September 1, 2025, weekly security roundup led with two issues that called for different responses: a WhatsApp flaw Meta said may have been used in sophisticated attacks against specific targets, and a Docker Desktop vulnerability that could let a malicious local container reach the Docker Engine API. WhatsApp users on affected Apple platforms should update both the app and their operating system; Docker Desktop users should upgrade to version 4.44.3 or later. These are historical disclosures, not newly reported August 2026 incidents.
At a glance
| Issue | Who should pay attention | Action |
|---|---|---|
| WhatsApp CVE-2025-55177 | Users of WhatsApp for iOS, WhatsApp Business for iOS, or WhatsApp for Mac; especially people at elevated risk of targeted surveillance | Update WhatsApp and iOS, iPadOS, or macOS. |
| Docker Desktop CVE-2025-9074 | Developers and organizations using Docker Desktop | Install Docker Desktop 4.44.3 or later and review any untrusted containers used while running a vulnerable version. |
| Other stories in the roundup | Organizations using the products and services named below | Assess each issue against your own software inventory; the list does not describe one coordinated incident. |
WhatsApp CVE-2025-55177: targeted exploitation, not evidence of a mass compromise
Meta described CVE-2025-55177 as an authorization flaw involving linked-device synchronization messages. According to Meta’s security advisory, an unrelated user could cause a target device to process content from an arbitrary URL. Meta assessed that the flaw may have been exploited in sophisticated attacks against specific targets.
That wording matters. It supports concern about real, targeted exploitation; it does not establish that every WhatsApp user was exposed to an attack or that there was a mass compromise. The advisory also does not mean every person who received an unexpected message was affected.
Affected WhatsApp products and fixed versions
| Product | Affected versions | Fixed version |
|---|---|---|
| WhatsApp for iOS | 2.22.25.2 through versions before 2.25.21.73 | 2.25.21.73 |
| WhatsApp Business for iOS | 2.22.25.2 through versions before 2.25.21.78 | 2.25.21.78 |
| WhatsApp for Mac | 2.22.25.2 through versions before 2.25.21.78 | 2.25.21.78 |
The published affected-version information concerns iOS and macOS products; it does not list WhatsApp for Android or WhatsApp Desktop for Windows as affected by this CVE. For current protection, update from the official App Store or WhatsApp distribution channel and check that the installed app is at least the fixed version shown above. Meta’s advisory includes a Mac desktop entry with an “unaffected” default status alongside an affected version range, so Mac users should use the version thresholds and update guidance rather than assuming an old installation is safe based on the label alone. The NIST National Vulnerability Database record provides a further reference for the CVE and affected ranges.
#1 Best Overall
Why Apple’s CVE-2025-43300 made the report more serious
Meta said CVE-2025-55177 may have been used together with Apple CVE-2025-43300 in a sophisticated campaign against specific users. In other words, the WhatsApp flaw was reported as part of a possible exploit chain involving an Apple operating-system vulnerability—not as proof that WhatsApp alone gave attackers universal access to every device.
“Zero-day” and “zero-click” are not synonyms. Zero-day describes exploitation before a fix or public disclosure is broadly available; zero-click describes an attack that requires little or no action by its target. The label in the 2025 roundup refers to the reported exploitation context. The issue had been fixed before the roundup appeared, so it should not be read as an unpatched WhatsApp vulnerability today.
What WhatsApp users should do
- Everyone using an affected Apple product: install available WhatsApp updates and update iOS, iPadOS, or macOS through Apple’s normal software-update mechanism.
- If you received a Meta or WhatsApp threat notification: treat it as an incident indicator. Preserve the notification and relevant device information; do not rely only on deleting a message or reinstalling the app.
- If you are at elevated risk—for example, a journalist, activist, executive, political figure, or another potential commercial-spyware target—consider specialist mobile incident response or forensics if you suspect targeting. For ordinary users without such indicators, the disclosed evidence does not justify assuming compromise.
Docker Desktop CVE-2025-9074: a container could reach the Engine API
CVE-2025-9074 affected Docker Desktop. The issue could allow a malicious Linux container running under Docker Desktop to reach the Docker Engine API through Docker Desktop’s internal network. The key risk is escalation from a container to Docker’s control plane: an attacker with that access could potentially create or control other containers and manage images. Under some Windows configurations using the WSL backend, the access could also allow mounting the host drive with the Docker Desktop user’s privileges.
The NVD description identifies Docker Desktop’s configured Docker subnet, with 192.168.65.7:2375 listed as the default API endpoint. This is not a claim that every Docker installation was exposed to the public internet, or that all native Linux Docker Engine deployments had the same flaw. The described path concerned containers and Docker Desktop’s internal networking.
A significant operational detail: Docker said the flaw could permit Engine API access without mounting the Docker socket into the container. Not mounting /var/run/docker.sock is normally a sensible restriction, but it was not sufficient protection against this particular issue.
Fixed release and Docker Desktop response
Docker fixed CVE-2025-9074 in Docker Desktop 4.44.3, released August 20, 2025. Upgrade to that release or a later one, then restart Docker Desktop. Verify the Docker Desktop application’s version in its About/version interface. The output of docker version can help with Docker components, but the Engine version and Desktop application version are not necessarily identical.
Docker explicitly stated that Enhanced Container Isolation (ECI) did not mitigate this vulnerability. Do not treat ECI, an unmounted Docker socket, or a disabled “Expose daemon on tcp://localhost:2375 without TLS” option as substitutes for installing the fix. Docker’s security announcements are the primary source for its fix and mitigation statement.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Developer and administrator checklist
- Inventory Docker Desktop installations on Windows and macOS endpoints, then enforce an upgrade to 4.44.3 or later through your normal endpoint-management process.
- Review whether developers ran untrusted images, third-party development containers, or other externally supplied workloads while using a vulnerable release.
- Consider what those containers could access: mounted directories, environment variables, SSH agents, cloud credentials, and other secrets. Rotate credentials if there is a plausible exposure or signs of compromise.
- If host or container compromise is plausible, review available Docker Desktop, container, and host logs and follow your incident-response process.
- Keep development credentials separate from production credentials. Organizations should also assess whether Docker Desktop and locally run untrusted workloads fit their endpoint-security policy.
What else was in the weekly recap?
The original roundup was a broad digest, not a single-incident report. It also covered Salesforce data-theft activity, fake CAPTCHA campaigns, spyware-related activity, and vulnerabilities affecting products including Sitecore, FreePBX, Tableau Server, Google Cloud Dataform, Chrome, Cisco infrastructure, Atlassian products, Hikvision HikCentral, and Linux UDisks. See The Hacker News’ September 1, 2025 roundup for its full selection and links.
Best Value
Those items should not be treated as equally urgent, or as evidence of one connected campaign. Prioritize using the relevant vendor advisories, whether a product is exposed to the internet, evidence of exploitation, and whether the affected software is actually present in your environment. A headline list is a useful alert, not a substitute for checking product-specific scope and remediation.
Practical response priorities
- Apple WhatsApp users: update WhatsApp and the operating system; high-risk users should promptly assess any direct threat notification or credible targeting indicator.
- Docker Desktop users: upgrade to 4.44.3 or later and restart the application. Do not rely on ECI as a workaround.
- Teams: inventory affected products and versions, check whether untrusted containers or sensitive credentials were involved, and rotate secrets where exposure is plausible.
- For suspected targeted spyware or host compromise: preserve relevant evidence and involve qualified incident-response specialists before resetting a device or endpoint if doing so could destroy useful evidence.
Together, the two lead stories illustrate why security triage must look beyond a single headline: application and operating-system flaws can be chained, while access to a container platform’s control interface can have consequences beyond one workload. The appropriate response depends on the affected product, its version, and evidence of exposure—not on assuming every user was compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
