Apple Urgently Patches Active Zero-Day Flaws in iOS and macOS That Grant Full Device Takeover Capabilities

Apple has issued urgent software updates for iPhones, iPads, and Mac computers to address two critical zero-day vulnerabilities actively being exploited in the wild. The newly released patches target flaws residing within the operating systems’ core kernel and the WebKit browser engine. According to security advisories published by the Cupertino-based tech giant, these vulnerabilities could allow malicious actors to execute arbitrary code with elevated privileges, potentially leading to a complete device takeover.

The emergency updates—designated as iOS 15.6.1 and iPadOS 15.6.1, alongside macOS Monterey 12.5.1—affect a wide array of devices capable of running these software versions. Security researchers and industry analysts are treating the situation with extreme gravity, warning that the nature of these exploits echoes high-profile, targeted cyberespionage campaigns reminiscent of mercenary spyware deployments like Pegasus. Users across the globe, particularly those in high-risk professions, have been strongly urged to apply the updates immediately.

Anatomy of the Vulnerabilities: Kernel and WebKit Flaws

The two vulnerabilities addressed in this security cycle target foundational components of Apple’s software ecosystem, making them particularly potent weapons for threat actors.

The first vulnerability, tracked as CVE-2022-32894, is a kernel-level bug impacting both iOS and macOS. The kernel serves as the core bridge between a device’s software and its underlying hardware, wielding the highest level of system privileges. Apple identified this flaw as an out-of-bounds write issue, which was successfully remediated through improved bounds-checking mechanisms. When successfully exploited, this bug enables a malicious application to execute arbitrary code with kernel privileges. In practical terms, this grants an attacker unrestricted access to the entire operating system, bypassing standard security sandboxes and safety protocols.

The second vulnerability, cataloged as CVE-2022-32893, targets WebKit, the open-source browser engine that powers Apple’s Safari web browser as well as all third-party web browsers operating on iOS and iPadOS. Similar to the kernel bug, this WebKit flaw is also characterized as an out-of-bounds write issue and was mitigated with enhanced bounds-checking. Attackers can exploit this vulnerability by tricking a user into processing maliciously crafted web content—often delivered via phishing links, compromised websites, or malicious advertisements. Once processed by the browser engine, this content triggers arbitrary code execution, laying the groundwork for further system compromise.

Although Apple has officially acknowledged reports indicating that both CVE-2022-32894 and CVE-2022-32893 "may have been actively exploited," the company has maintained its standard policy of withholding granular technical details regarding the attacks. This precautionary measure aims to prevent other malicious actors from reverse-engineering the patches to develop their own exploits before the wider user base has secured their devices.

The Discovery and the Threat of Pegasus-Like Surveillance

Both zero-day vulnerabilities were discovered and reported to Apple by an anonymous security researcher. While public details remain scarce, the identification of concurrent kernel and browser engine exploits immediately drew comparisons to sophisticated, state-sponsored cyberweapons.

Cybersecurity experts have noted that the ability to chain a WebKit remote code execution bug with a kernel privilege escalation flaw is a hallmark of advanced persistent threat (APT) groups. Such methodology allows threat actors to orchestrate a "drive-by" compromise—where simply visiting a malicious webpage can infect a device without requiring any user interaction beyond clicking a link—followed by a deep escalation into the operating system’s core.

This attack chain closely mirrors historical campaigns involving Pegasus, the notorious spyware developed by the Israeli cyber-arms firm NSO Group. Pegasus infamously leveraged zero-click and one-click exploits against iOS devices to covertly siphon messages, record calls, track locations, and harvest sensitive data from the phones of journalists, human rights activists, political dissidents, and government officials worldwide.

The severity of the current threat prompted immediate reactions from prominent digital security figures. Rachel Tobac, CEO of SocialProof Security, took to social media to urge immediate action. "For most folks: update software by end of day," Tobac tweeted following the release of the patches. For individuals whose threat models are elevated—such as journalists, activists, and high-profile targets of nation-state surveillance—she emphasized an even more urgent directive: "Update now."

A Broader Pattern of Zero-Days in Modern Software

The emergency patches from Apple arrived during a particularly volatile week for enterprise cybersecurity. Coincidentally, Google announced its own emergency security updates for the Chrome browser, patching the fifth zero-day vulnerability of the year actively being exploited in the wild. The clustering of these high-severity disclosures underscores a persistent reality of the modern digital landscape: despite unprecedented investments in software security and defensive engineering by major tech conglomerates, keeping pace with determined and well-resourced threat actors remains an uphill battle.

Andrew Whaley, senior technical director at Norwegian app security firm Promon, emphasized that the prevalence of iOS vulnerabilities is particularly alarming due to the sheer ubiquity of iPhones and the profound reliance individuals place on mobile devices for daily personal and professional functions.

"While we all rely on our mobile devices, they are not invulnerable, and as users we need to maintain our guard just like we do on desktop operating systems," Whaley stated. He further stressed that the burden of cybersecurity cannot rest solely on operating system vendors. App developers, particularly those building software for sensitive sectors like mobile banking and enterprise productivity, must implement robust, multi-layered security controls within their applications rather than relying entirely on the underlying OS for protection.

According to Whaley, many third-party applications still fail to deploy adequate self-protection mechanisms, potentially exposing consumers to secondary exploitation even if operating system patches are applied.

Official Guidance and Recommendations for Users

Apple’s advisory covers a broad range of hardware, reinforcing the sprawling reach of the patched codebases. The updates apply to:

• iPhone 6s and later
• iPad Pro (all models)
• iPad Air 2 and later
• iPad 5th generation and later
• iPad mini 4 and later
• iPod touch (7th generation)
• Mac computers running macOS Monterey

Security operations centers and IT administrators worldwide are advising organizations to verify that all corporate-owned and Bring Your Own Device (BYOD) endpoints have successfully completed the update cycle. For individual users, the remediation steps are straightforward but time-sensitive: navigating to the device settings menu, selecting general software updates, and applying iOS 15.6.1 or macOS Monterey 12.5.1 immediately.

As threat actors continue to weaponize zero-day vulnerabilities with increasing frequency and sophistication, the rapid deployment of patches remains the frontline defense for digital hygiene. The discovery and mitigation of CVE-2022-32894 and CVE-2022-32893 serve as a stark reminder that the digital devices central to modern life are perpetual targets, requiring constant vigilance from developers, enterprises, and everyday consumers alike.