APPLE PATCHES TWO ZERO-DAY IOS FLAWS USED IN TARGETED ATTACKS

Apple has released security updates addressing two previously unknown vulnerabilities that the company said were actively exploited in what it described as sophisticated attacks.

- 

The fixes were delivered through emergency patches for iOS and iPadOS, underscoring the continued focus on closing security gaps that can be abused before researchers or vendors are aware they exist.

The two flaws were identified as zero-day vulnerabilities, meaning they were exploited before Apple had released a fix or publicly disclosed their existence. According to Apple's security advisories, both issues could allow attackers to compromise devices under specific conditions, prompting the company to urge users to install the updates as soon as possible.

The vulnerabilities were addressed in software updates for supported iPhone and iPad models, as well as other Apple operating systems that share common code. Apple did not disclose details about the targets of the attacks or how widely they were used, which is consistent with its standard practice when dealing with active exploitation.

DETAILS OF THE ZERO-DAY VULNERABILITIES

Apple said the first vulnerability affected the operating system's handling of memory, allowing an attacker to execute arbitrary code with kernel privileges. Kernel-level access is considered particularly sensitive because it can give an attacker extensive control over a device, including the ability to bypass security protections that normally isolate apps from one another.