PKF Thailand Transparency Report 2025

PKF Thailand is pleased to present our inaugural transparency report for the year ended 30 June 2025. It provides an overview of PKF Thailand’s operations and gives insight on the ownership and governance of our firm, and our approach to maintaining high quality standards in our audit and other services.

 CVE-2025-43300 vulnerability :Understanding Apple’s ImageIO Framework

Introduction Apple’s ecosystem is well-known for its seamless user experience. One of the unsung heroes behind this smooth interaction with digital images is the ImageIO Framework. This framework provides developers with a standardized way to read, write, and process image files across iOS and macOS. While ImageIO makes handling images efficient and reliable, it is […]

NCSA Urges Immediate Update to iOS 18.6.2 and iPadOS 18.6.2 Following Discovery of Critical Vulnerability

The National Cyber Security Agency (NCSA) of Thailand has issued an urgent advisory for all users of iPhone and iPad devices to promptly update to iOS 18.6.2 and iPadOS 18.6.2, following the identification of a critical security vulnerability tracked as CVE-2025-43300 within Apple’s ImageIO Framework. This vulnerability, classified as a zero-day, has reportedly been exploited in targeted attacks. According to Apple’s official security […]

Outsourcing Without Oversight: PDPA Penalties Hit Healthcare Sector

On August 1, 2025, Thailand’s Personal Data Protection Committee (PDPC) issued a formal statement regarding a serious data breach involving a prominent private hospital. The incident has sparked widespread attention across social media and raised concerns about data governance in the healthcare sector. Incident Overview The hospital, acting as the Data Controller, had outsourced the […]

How attackers are still phishing “phishing-resistant” authentication

🔐 Overview Despite the rise in phishing‑resistant authentication methods such as FIDO2-based passkeys, WebAuthn, Windows Hello, and physical security keys attackers continue to successfully bypass them using more sophisticated phishing techniques. 🧪 Attack Techniques Used 1. Downgrade Attacks 2. Device‑Code Phishing 3. Consent Phishing (OAuth Abuse) ⚖️ Why These Methods Still Work ✅ Mitigation Strategies […]