Apple Urgently Patches Active iOS and macOS Zero-Day Vulnerabilities That Give Attackers Full Device Control

Apple has issued urgent software updates for iPhones, iPads, and Mac computers to address two critical zero-day vulnerabilities that are actively being exploited in the wild. The newly released patches target serious security flaws residing deep within the operating system kernel and the WebKit browser engine. According to security advisories published by the technology giant, these vulnerabilities could allow malicious actors to execute arbitrary code with elevated privileges, effectively granting them complete, unfettered access to compromised devices.

The emergency updates—designated as iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1—affect a wide array of hardware. This includes virtually all modern iPhone models starting from the iPhone 6s, several generations of iPads, and Mac computers running the macOS Monterey operating system. Because threat actors are already weaponizing these exploits in targeted attacks, cybersecurity agencies and corporate security teams worldwide have joined Apple in strongly urging users to apply the patches immediately.

Anatomy of the Critical Flaws

The two vulnerabilities share a common technical root cause: improper input validation leading to out-of-bounds memory writes. In software engineering, an out-of-bounds write occurs when a program writes data past the end, or before the beginning, of the intended buffer. This memory corruption can allow an attacker to overwrite adjacent memory structures, manipulate application logic, and ultimately execute unauthorized code on the host device.

The first vulnerability, tracked as CVE-2022-32894, is a kernel-level bug impacting both iOS and macOS. The kernel serves as the core foundation of an operating system, sitting as a bridge between applications and the actual data processing hardware. It holds the highest level of privileges and manages system resources, memory, and security enforcement. Because CVE-2022-32894 exists within the kernel, a successful exploit allows a malicious application or process to break out of its sandbox and execute arbitrary code with kernel-level privileges. This effectively hands the attacker the keys to the kingdom, providing the capability to bypass system defenses, install persistent surveillance tools, access private user data, and manipulate core system functions without the user’s knowledge. Apple addressed this flaw by implementing improved bounds checking to prevent out-of-bounds memory access.

The second flaw, cataloged as CVE-2022-32893, targets WebKit, the open-source browser engine that powers Apple’s Safari web browser. Due to Apple’s strict platform guidelines, WebKit is also mandated as the underlying engine for all third-party web browsers—such as Google Chrome and Mozilla Firefox—running on iOS and iPadOS. Like its kernel counterpart, this WebKit vulnerability is an out-of-bounds write issue resolved through enhanced bounds checking. In a typical attack scenario, a threat actor can craft a malicious web page or deliver corrupted web content via phishing messages, compromised websites, or rogue advertisements. When an unsuspecting user views this content using an unpatched device, WebKit processes the data incorrectly, triggering memory corruption and allowing the attacker to achieve remote code execution.

Echoes of Advanced Spyware and Targeted Attacks

Although Apple’s public disclosures remain characteristically sparse regarding the precise nature of the active exploits, the discovery and characteristics of these vulnerabilities have drawn immediate comparisons to sophisticated, targeted surveillance campaigns of the past. The vulnerabilities were independently discovered and reported to Apple by an anonymous security researcher. However, the potential impact of vulnerabilities that combine arbitrary code execution in both a widely used web browser and the core operating system kernel cannot be overstated.

Cybersecurity experts have noted that flaws of this caliber frequently form the backbone of modern mercenary spyware deployments. In a scenario reminiscent of the infamous Pegasus spyware developed by the Israeli cyber-arms firm NSO Group, threat actors can leverage these zero-days to execute zero-click or low-interaction watering-hole attacks. In such campaigns, high-value targets—including investigative journalists, political dissidents, human rights activists, and government officials—can be compromised simply by visiting a compromised website or receiving an invisible, weaponized text message. Once the WebKit exploit is triggered, the attacker can use the kernel vulnerability to escalate privileges, install rootkits, harvest cryptographic keys, extract encrypted messaging databases, and turn the smartphone into a real-time surveillance beacon that records audio, video, and location data.

Rachel Tobac, chief executive officer of SocialProof Security, emphasized the urgency of the situation on social media, advising standard users to update their software by the end of the day. For individuals whose threat models are elevated due to their profession, public profile, or geopolitical standing, Tobac urged immediate action without delay.

A Broader Landscape of Pervasive Zero-Days

The disclosure of the Apple zero-days arrives amid a turbulent period for enterprise and consumer cybersecurity. Coinciding with Apple’s emergency patches, Google released an urgent security update for its Chrome web browser to fix its fifth zero-day vulnerability of the year—another arbitrary code execution bug that was similarly confirmed to be under active exploitation in the wild.

The convergence of multiple zero-day vulnerabilities across dominant software ecosystems highlights an uncomfortable reality for the modern technology landscape. Despite massive investments in secure coding practices, automated fuzzing, internal security audits, and bug bounty programs, major platform vendors continue to face a relentless uphill battle in keeping pace with sophisticated adversaries.

Andrew Whaley, senior technical director at Norwegian app security firm Promon, observed that vulnerabilities impacting mobile operating systems are particularly alarming given society’s near-total reliance on smartphones for daily life, financial transactions, and professional communication. Whaley noted that while operating system vendors bear a heavy responsibility for securing their software, the defense of digital assets cannot rest solely on the shoulders of the platform creators.

"While we all rely on our mobile devices, they are not invulnerable, and as users we need to maintain our guard just like we do on desktop operating systems," Whaley stated. He further emphasized that developers of mobile applications—particularly those operating in high-security sectors like banking, healthcare, and enterprise management—must integrate independent, defense-in-depth security controls directly into their applications rather than blindly trusting the underlying operating system to provide absolute protection. According to Whaley, widespread failure to implement these redundant security layers leaves consumers needlessly exposed when OS-level flaws inevitably emerge.

Timeline and Chronology of the Disclosures

The release of iOS 15.6.1 and macOS Monterey 12.5.1 marks a critical milestone in Apple’s ongoing battle against active zero-day exploitation. To understand the gravity of these discoveries, it is helpful to examine the timeline of recent high-profile mobile vulnerabilities and Apple’s response mechanisms:

• September 2021: Apple rushed out emergency patches for iOS 14.8 to block the "FORCEDENTRY" zero-click exploit used by the NSO Group to install Pegasus spyware via iMessage without any user interaction.
• January 2022: Apple released iOS 12.5.5, iOS 15.2.1, and macOS Monterey 12.1 to address multiple WebKit and kernel vulnerabilities that allowed arbitrary code execution and memory corruption.
• March 2022: Apple patched two critical zero-day flaws (CVE-2022-22675 and CVE-2022-22587) involving an out-of-bounds write in the AppleAVD media decoder and an IOMobileFrameBuffer corruption issue, both of which were actively exploited.
• August 2022: Apple officially published security advisories for iOS 15.6.1 and macOS Monterey 12.5.1, detailing the kernel bug (CVE-2022-32894) and the WebKit bug (CVE-2022-32893). Security researchers noted that these vulnerabilities affect devices running the iOS 15 branch and Monterey desktop OS, raising questions about whether users running older, legacy operating systems remain unprotected.

Implications for Enterprises and Consumers

The active exploitation of kernel and browser zero-days carries profound implications for both individual privacy and corporate security frameworks. As organizations increasingly embrace Bring Your Own Device (BYOD) policies and remote work models, personal smartphones and laptops frequently serve as dual-use endpoints connected to corporate cloud infrastructure, internal networks, and sensitive databases.

When a nation-state actor or financially motivated cybercrime syndicate successfully compromises an unpatched personal device via a WebKit or kernel exploit, corporate perimeters are effectively bypassed. Attackers can leverage compromised endpoints to harvest session tokens, intercept multi-factor authentication codes, execute lateral movement within enterprise environments, and exfiltrate proprietary intellectual property.

Consequently, modern endpoint detection and response (EDR) strategies must evolve to account for mobile vulnerabilities. Security teams can no longer assume that stock mobile operating systems are impregnable fortresses. Organizations are increasingly deploying mobile threat defense (MTD) solutions capable of monitoring device integrity, detecting anomalous network traffic, and identifying signs of jailbreaking or unauthorized privilege escalation.

Recommended Action Plan for Users and Administrators

In light of the active exploitation status of CVE-2022-32893 and CVE-2022-32894, cybersecurity authorities recommend taking the following immediate steps:

1. Update Operating Systems Immediately: Users of supported Apple hardware should navigate to Settings > General > Software Update on their iPhones and iPads, and System Preferences > Software Update on their Macs, to download and install the latest patches (iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1).
2. Enable Automatic Updates: To minimize the window of exposure during future zero-day disclosures, users should configure their devices to install security updates automatically.
3. Exercise Heightened Vigilance: Given that WebKit vulnerabilities are frequently delivered via malicious links or compromised web pages, users should exercise extreme caution when clicking on unsolicited URLs received via text message, email, or social media platforms.
4. Corporate Enforcement: IT and security administrators should utilize Mobile Device Management (MDM) platforms to audit device compliance across the enterprise fleet, enforcing strict policies that block network access for any endpoint running unpatched operating system versions.

As threat actors continue to professionalize their operations and weaponize complex memory corruption vulnerabilities with increasing frequency, the race between software vendors and malicious exploit developers remains ongoing. For Apple device owners, applying the latest round of security updates represents the single most critical line of defense against active device compromise.