Apple issues emergency update for iPhones, Macs and Apple Watches — what to do now [updated]

News
By last updated

Download updates for your devices ASAP

An iPhone in sharp focus with a MacBook in the background.
(Image credit: Yalcin Sonat/Shutterstock)

Updated to include comment from Apple and NSO Group.

Apple on Monday (Sept. 13) released updates for iOS, iPadOS, macOS, watchOS and Safari to fix two zero-day flaws that are actively being exploited by hackers. At least one of the flaws has been used by commercial spyware to break into the phones of political activists in Persian Gulf countries.

We know some details about one of the two flaws, catalogued as CVE-2021-30860, which affects the Apple CoreGraphics component on iOS, iPadOS, watchOS, Big Sur and Catalina, but not Safari on its own. 

Apple's security advisories state that because of this vulnerability, "processing a maliciously crafted PDF may lead to arbitrary code execution." In other words, if you view a booby-trapped PDF, your system can be hacked over the internet.

This flaw was discovered last month by Citizen Lab researchers at the University of Toronto who had examined the iPhones of nine Bahraini dissidents. The researchers called the exploit of the vulnerability "FORCEDENTRY" and said it was used by the Pegasus spyware, commercial spyware developed and distributed by Israel-based NSO Group. 

Today, Citizen Lab disclosed that the same exploit was used on an iPhone belonging to a Saudi political activist. The exploit permits takeover of an iPhone if the user receives a message in iMessage. No user action is needed to trigger the exploit, leading information-security experts to call it a "zero-click exploit."

The other vulnerability, catalogued as CVE-2021-30858, is more mysterious. It is a flaw in WebKit, the Safari rendering engine, and its discovery is credited to "an anonymous researcher." 

Apple states that "processing maliciously crafted web content may lead to arbitrary code execution" — again, nasty web stuff can hack your device.

This flaw affects iOS, iPadOS, Big Sur and Safari, but not watchOS or Catalina. As with the other flaw, Apple says that it is "aware of a report that this issue may have been actively exploited."

Soon after Apple released the patches, Reuters posted a story about the intelligence services of the United Arab Emirates hacking the iPhones of domestic political activists and foreign diplomats and politicians. It's not yet clear whether either zero-day flaw patched today is involved.

Apple kicks off its annual fall extravaganza Tuesday (Sept. 14), and it's likely that the iPhone 13 will be unveiled along with iOS 15. 

Comment from Apple and NSO Group

Apple later on Monday released the following statement to media outlets, attributable to Ivan Krstić, the company's head of security engineering.

"After identifying the vulnerability used by this exploit for iMessage, Apple rapidly developed and deployed a fix in iOS 14.8 to protect our users. We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly. 

Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals. While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data."

In a statement to media, NSO Group had this to say.

"NSO Group will continue to provide intelligence and law-enforcement agencies around the world with life-saving technologies to fight terror and crime."

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.