Apple Urgently Patches Active Zero-Day Flaws in iOS and macOS That Grant Full Device Takeover Capabilities

Apple has issued urgent software updates for iPhones, iPads, and Mac computers to address two critical zero-day vulnerabilities that are actively being exploited in the wild. The Cupertino-based technology giant released iOS 15.6.1 and iPadOS 15.6.1, alongside macOS Monterey 12.5.1, following discoveries that threat actors could leverage these flaws to execute arbitrary code with elevated privileges, effectively bypassing core security controls and taking complete control of affected user devices.

The disclosure of these vulnerabilities highlights a persistent and growing challenge for major technology companies: defending complex operating systems against sophisticated adversaries. Security researchers and industry experts are urging all users to apply the patches immediately, noting that the nature of the exploits places high-risk individuals—such as journalists, human rights activists, and political dissidents—at severe risk of targeted surveillance and espionage.

Anatomy of the Critical Flaws

The two vulnerabilities span both Apple’s mobile and desktop ecosystems, impacting the kernel and the browser engine. Although Apple has maintained its characteristic discretion regarding the specifics of the active exploitation campaigns, the technical details provided in the security advisories outline significant risks to user data and device integrity.

The first vulnerability, cataloged as CVE-2022-32894, is a kernel-level bug affecting both iOS and macOS. The kernel sits at the absolute core of the operating system, bridging the gap between physical hardware and software applications. According to Apple’s advisory, the flaw is an out-of-bounds write issue that has been resolved through the implementation of improved bounds checking. If successfully exploited, this bug allows a malicious application to execute arbitrary code with kernel privileges. In practical terms, possessing kernel privileges means an attacker has unfettered access to the entire device, capable of bypassing security sandboxes, accessing sensitive user data, installing persistent spyware, and disabling security monitoring tools.

The second vulnerability, tracked as CVE-2022-32893, is located within WebKit, the underlying browser engine that powers Safari as well as all third-party web browsers operating on iOS and iPadOS. Like its kernel counterpart, this flaw is also characterized as an out-of-bounds write issue addressed via enhanced bounds checking. The vulnerability allows threat actors to process maliciously crafted web content—such as a compromised webpage or an embedded advertisement—that leads to arbitrary code execution on the target device. Because web browsing is an integral part of daily mobile and desktop use, a WebKit vulnerability presents a particularly dangerous vector for drive-by downloads and watering-hole attacks, where users can be compromised simply by visiting a malicious website without interacting with any downloads.

While Apple credited an anonymous researcher with discovering and reporting both flaws, the company acknowledged receiving credible reports indicating that the vulnerabilities have already been actively exploited in real-world attacks. However, Apple has refrained from publishing details regarding the scope of the attacks, the identity of the threat actors, or the specific targets involved.

Parallels to Advanced Mobile Espionage and the Pegasus Threat

The ability of these zero-day exploits to grant unauthorized kernel-level access has drawn immediate comparisons to previous high-profile spyware campaigns, most notably those orchestrated by the NSO Group using the infamous Pegasus spyware. In those historical incidents, zero-click and zero-day exploits targeting iOS vulnerabilities were deployed by nation-state advanced persistent threat (APT) groups to silently compromise the devices of journalists, diplomats, and political figures worldwide.

Security analysts emphasize that the combination of a WebKit exploit and a kernel exploit is a classic playbook for full-chain attacks. In such a scenario, an initial entry point—such as a maliciously crafted website or a targeted link delivered via messaging applications—exploits the browser engine to gain a foothold on the device. Once inside the browser sandbox, the attacker leverages the kernel vulnerability to break out of the sandbox, escalate privileges, and seize total control of the hardware.

Rachel Tobac, CEO of SocialProof Security, underscored the severity of the situation in public statements following the patch releases. For the general public, Tobac recommended updating software by the end of the day. However, for individuals whose threat models are elevated—such as investigative journalists, political activists, dissidents, or corporate executives handling sensitive information—she stressed the need for immediate action, warning that sophisticated attackers often weaponize such vulnerabilities rapidly before defenders can deploy mitigations.

A Broader Trend of Zero-Days in Modern Software

The unveiling of these Apple zero-days coincided with similar disclosures across the technology sector. Google recently announced that it was patching the fifth zero-day vulnerability of the year in its Chrome web browser, another arbitrary code execution bug actively exploited by malicious actors. The simultaneous emergence of critical vulnerabilities across products from Apple and Google illustrates the immense difficulty of securing massive, feature-rich codebases against relentless and well-resourced adversaries.

Andrew Whaley, senior technical director at Promon, a Norwegian application security firm, noted that the persistent barrage of zero-day exploits demonstrates that software security remains an uphill battle. Whaley pointed out that vulnerabilities in iOS are particularly alarming due to the ubiquity of iPhones and the deep reliance modern consumers place on mobile devices for managing personal lives, professional communications, and financial transactions.

Furthermore, industry experts emphasize that the responsibility for security cannot fall solely on the shoulders of platform developers like Apple or Google. While operating system vendors must continue to harden their software architecture, end-users must also cultivate a heightened sense of digital hygiene. Mobile devices, despite their polished interfaces and closed application ecosystems, are not invulnerable endpoints. Users must adopt the same rigorous security mindset toward their smartphones and tablets that they traditionally apply to desktop and laptop computers, including prompt installation of security updates, cautious navigation of unfamiliar links, and skepticism toward unsolicited communications.

Implications for App Developers and Enterprise Security

The frequency with which core operating system vulnerabilities appear has also prompted discussions regarding the architecture of third-party mobile applications. Security professionals argue that developers cannot afford to rely exclusively on the security controls provided by the underlying iOS or Android operating systems. Because kernel and framework flaws inevitably emerge, developers of sensitive applications—particularly those in banking, fintech, healthcare, and enterprise productivity—must implement additional layers of defense-in-depth within their own software.

Techniques such as runtime application self-protection (RASP), code obfuscation, integrity checks, and device posture assessment can help applications detect if an operating system has been compromised, rooted, or jailbroken. Unfortunately, industry observations suggest that many application developers still fail to incorporate these auxiliary security measures, potentially leaving consumers exposed even when operating systems experience temporary security gaps.

Chronology and Remediation Steps

The release of iOS 15.6.1 and macOS Monterey 12.5.1 follows a regular cadence of security updates by Apple, though the out-of-band nature of these patches underscores their urgency. Devices impacted by these updates include iPhones 6s and later, all models of iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation), alongside Mac computers running macOS Monterey.

Apple users are strongly advised to verify that their devices are updated to the latest software versions immediately. To update an iPhone or iPad, users should navigate to Settings > General > Software Update. For Mac users, updates can be accessed by opening System Preferences and selecting Software Update. Ensuring these patches are applied closes the specific vectors utilized in the recent wave of exploitation, mitigating the risk of arbitrary code execution and unauthorized device access.

As threat actors continue to invest heavily in discovering and weaponizing zero-day vulnerabilities, the cybersecurity landscape demands continuous vigilance from vendors, developers, and end-users alike. The rapid response by Apple to remediate CVE-2022-32894 and CVE-2022-32893 demonstrates the ongoing arms race between defenders and attackers in the digital domain, highlighting that timely patching remains the single most effective defense against active exploitation.