![\"Apple](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/12\/1765631064_275_0x0.jpg\")
<\/p>\n<\/p>\n
Confirmation of iPhone attacks.<\/p>\n
NurPhoto via Getty Images<\/p>\n
Apple has just warned<\/a> that two iPhone vulnerabilities \u201cmay have been exploited in an extremely sophisticated attack against specific targeted individuals.\u201d It follows this month\u2019s spyware<\/a> warnings, issued to iPhone users around the world. <\/p>\n Both vulnerabilities have now been fixed in iOS 26.2<\/a>, released today. But while the update now message applies to users already running iOS 26, there\u2019s a more serious warning for those yet to upgrade. These attacks targeted individuals \u201con versions of iOS before iOS 26.\u201d And even though iOS 18 is still being patched, it\u2019s not worth the risk. Apple wants you to upgrade. You should do exactly that.<\/p>\n Forbes\u2018It May Be Worse\u2019\u2014No Fix For New Google Chrome AttacksBy Zak Doffman<\/a><\/p>\n Apple has disclosed that the two vulnerabilities are linked. CVE-2025-14174 and CVE-2025-43529 were both \u201cissued in response to this report.\u201d One is attributed to Google\u2019s Threat Analysis Group, the other to Google\u2019s threat hunters and Apple itself. <\/p>\n And both affect WebKit. One, Apple says, risks a browser \u201cprocessing maliciously crafted web content (that) may lead to arbitrary code execution.\u201d While the other \u201cmay lead to memory corruption.\u201d This has the hallmarks of a chained spyware attack.<\/p>\n \u201cIn all probability, these vulnerabilities have been chained to achieve exploitation,\u201d Mayuresh Dani from Qualys told me. \u201cWebKit has a well-documented history of serving as the primary entry point for sophisticated spyware and surveillance campaigns.\u201d That includes \u201cnow infamous monitoring spywares such as Pegasus, which have consistently relied on WebKit vulnerabilities as its primary attack vector.\u201d<\/p>\n The two exploited vulnerabilities are amongst eight WebKit threats patched in this release. Others are various types of memory mishandling, which opens the door to destabilizing an app or the OS, potentially allowing other types of exploits to be used. Again, just more reasons to ensure you install the update as soon as it shows available.<\/p>\n We have seen WebKit zero-day attacks<\/a> before. It\u2019s a prime target<\/a> for spyware developers building and marketing exploits. These latest vulnerabilities can be added to the \u201c17 zero-day bugs in WebKit that attackers have exploited in the wild<\/a>\u201d since 2023. And while these are targeted at very specific individuals, vulnerabilities have a nasty habit of getting into the wild and spreading further down the food chain.<\/p>\n \u201cUsers should urgently update all their impacted Apple devices,\u201d James Maude from BeyondTrust warns. \u201cEven though this only appears to be linked to a small number of targeted attacks it will quickly become a must have exploit for a range of threat actors.\u201d<\/p>\n There is a further risk to users beyond the two exploited vulnerabilities, now that iOS 26\u2019s fixes are in the public domain. For example, \u201can app may be able to access sensitive user data\u201d in Messages or \u201cpassword fields may be unintentionally revealed when remotely controlling a device over FaceTime.\u201d <\/p>\n At the beginning of December, Google also warned that its OS was under attack<\/a>. Again it was two vulnerabilities that were being exploited in the wild to target Android users. It rushed out an emergency update within hours and Pixels were patched<\/a> within days. <\/p>\n ForbesSamsung Surprises Millions Of Users With Emergency Android UpdateBy Zak Doffman<\/a><\/p>\n This isn\u2019t the first time we\u2019ve seen Android and iPhone attacks disclosed and addressed the same month. Both operating systems are being attacked by the same mercenary spyware industry, so it should be no surprise. Both Apple and Google have done a good job in rushing out fixes to everyone, everywhere. The caveat on the Android side is that this only works for Pixels. Other OEMs \u2014 Samsung for example<\/a> \u2014 cannot do the same.<\/p>\n