Apple announced on its Security Update Page that they’re aware of the vulnerability and that it may have been actively exploited. This is Apple’s way of saying that the vulnerability was reported by users in the real world as opposed to researchers. Apple credited an anonymous researcher for bringing the vulnerability to their attention. They also thanked Citizen Lab for their assistance in the matter.
Citizen Lab is a digital rights research group. The company operated from the University of Toronto’s Munk School. They’re most well known for exposing government hacking tools, such as those made by the infamous NSO Group.
Scott Radcliff, an Apple Spokesperson, mentioned that at this stage Apple has nothing more to add besides the release notes. Similarly, Bill Marczak from Citizen Lab also reported that he cannot make a comment at this time.
This latest bug was discovered in WebKit, which is Apple’s browser engine used in Safari. This is a historically popular target for hackers, as it opens up access to the rest of the data on the device. This isn’t good news, as it dregs up past vulnerabilities.
Back in 2021, Motherboard, the online magazine dedicated to technology, reported that in the first four months of the year, Apple already had to patch seven vulnerabilities. These vulnerabilities were also exploited in the wild, just like the latest one. Of these seven bugs, six were WebKit. This number was considered high for the time.
However, things have improved tremendously since 2021. From January 2022 up to now, Apple has only reported nine bugs that may have been actively exploited in the wild. Of that total, only four were found in WebKit, three in the kernel, one in AppleAVD, and one in OMobileFrameBuffer.
While it’s very unlikely that the average iPhone user will be targeted by these zero-day attacks, it’s still recommended that all users update their operating systems. The new update will patch this vulnerability and protect users from hackers. Currently, the release notes don’t give a lot of details on how the vulnerability was exploited. This is probably because the matter is still being investigated.
If you have an Apple iPhone or iPad, you can manually download and install the update from Apple’s Security Update page. Alternatively, you can wait for the automatic update, but that will mean the vulnerability will still be on your device until you update to the newest version.
