Archive — US — techcrunch
Apple says zero-day bugs exploited against ‘specific targeted individuals’ usingiOS
Apple has released software updates to fix two zero-day vulnerabilities exploited in targeted attacks against iOS users. The vulnerabilities, linked to sophisticated attacks potentially from state actors, were unknown to Apple before discovery. One bug affects CoreAudio, allowing malicious code execution, while the other enables bypassing security features. Updates were made for various Apple products, including iPhones, iPads, and macOS.
Key points
- Apple released updates for macOS and iOS to patch two critical security vulnerabilities.
- The vulnerabilities were zero days, meaning they were exploited before Apple knew about them.
- The attacks were sophisticated and possibly linked to government-backed entities.
- One bug in CoreAudio can execute malicious code through malicious media files.
- The second bug allows for bypassing pointer authentication, easing exploitation.
- Updates include macOS 15.4.1 and iOS 18.4.1 across multiple devices.
Why it matters
- Heightened cybersecurity awareness and response due to increasing government-backed cyber threats in recent years.
- Growing concerns over privacy and security in mobile technology as more devices become interconnected.
- Discussion on the implications of zero-day vulnerabilities and the necessity for robust software security measures.
The recent zero-day exploits against iOS users underline pressing vulnerabilities in mobile software, necessitating urgent updates and greater security measures across the tech industry to protect against sophisticated cyber threats.