Apple Urgently Patches Critical iOS and macOS Zero-Day Vulnerabilities Actively Exploited in the Wild

Apple has issued an urgent nationwide and global advisory, compelling users of iPhones, iPads, and Mac computers to update their operating systems immediately. The emergency software updates are designed to patch two high-severity zero-day vulnerabilities that the technology giant confirmed are actively being exploited in real-world attacks. These critical security flaws could allow malicious actors to execute arbitrary code with elevated privileges, effectively granting them full, unhindered control over compromised devices.

The security updates apply to a wide range of devices and are designated under iOS 15.6.1 and iPadOS 15.6.1, alongside macOS Monterey 12.5.1. According to advisories published by Apple’s Product Security team, the vulnerabilities impact virtually any supported Apple hardware running these operating systems. Given the severe nature of the flaws and confirmation that they are already being leveraged by threat actors, cybersecurity experts are strongly advising all users to apply the patches without delay.

Anatomy of the Vulnerabilities: Kernel and WebKit Flaws

The two separate zero-day vulnerabilities target core components of Apple’s operating system architecture—specifically, the operating system kernel and the WebKit browser engine. Although discovered by an anonymous security researcher who reported them responsibly to Apple, threat actors managed to weaponize them before patches could be developed and deployed.

The first vulnerability, cataloged as CVE-2022-32894, is a critical kernel-level bug affecting both iOS and macOS. In its technical advisory, Apple described the flaw as an out-of-bounds write issue that has since been mitigated through improved bounds checking. The kernel sits at the very heart of an operating system, managing system resources, hardware interactions, and memory security. Because the kernel possesses the highest level of system privileges, a successful exploit of CVE-2022-32894 allows malicious applications or processes to execute arbitrary code with kernel-level access. In practical terms, this grants an attacker complete sovereignty over the underlying device, enabling them to bypass security sandboxes, access sensitive data, install persistent malware, and monitor user activity.

The second vulnerability, tracked as CVE-2022-32893, targets WebKit, the underlying browser engine that powers Apple’s Safari web browser as well as all third-party web browsers operating on iOS and iPadOS. Like its kernel counterpart, this flaw is also categorized as an out-of-bounds write issue and was resolved by Apple via enhanced bounds checking mechanisms. This vulnerability can be triggered when a user navigates to or processes maliciously crafted web content. Once successfully exploited, it can lead to arbitrary code execution, meaning attackers could compromise a device simply by luring a target to a malicious website or serving malicious ads via compromised web banners—a technique commonly referred to as a drive-by download attack.

The Specter of Advanced Mobile Espionage and Pegasus-Like Scenarios

The discovery and active exploitation of these zero-day vulnerabilities have drawn immediate comparisons to sophisticated, state-sponsored spyware campaigns, most notably the infamous Pegasus spyware developed by the Israeli cyber-intelligence firm NSO Group. Security analysts examining the technical markers of CVE-2022-32894 and CVE-2022-32893 warn that the combination of a WebKit entry point and a kernel escalation vector represents a classic, highly effective weapon chain utilized by advanced persistent threat (APT) groups.

In historical attacks involving Pegasus, threat actors routinely deployed zero-click or one-click exploits targeting browser engines to gain an initial foothold on a mobile device, subsequently leveraging kernel vulnerabilities to escalate privileges, install rootkits, and harvest encrypted communications, location data, photographs, and microphone recordings. While Apple’s official security bulletins did not explicitly attribute the recent attacks to a specific nation-state or commercial spyware vendor, the potential implications are stark.

High-profile individuals, including investigative journalists, human rights activists, political dissidents, and corporate executives who frequently find themselves in the crosshairs of state-sponsored intelligence agencies, are considered prime targets for such exploits. Rachel Tobac, Chief Executive Officer of SocialProof Security, underscored the urgency of the situation in public statements following the patch release. "For most folks: update software by end of day," Tobac advised via social media. "If your threat model is elevated—such as being a journalist, activist, or targeted by nation-states—update now."

Broader Industry Context: A Relentless Wave of Zero-Days

The disclosure of these Apple zero-days arrives amidst a broader wave of emergency patching across the technology sector. Just days prior to Apple’s security release, Google announced emergency patches for its Chrome browser, addressing its fifth actively exploited zero-day vulnerability of the calendar year. This convergence of high-profile vulnerabilities highlights a sobering reality in modern cybersecurity: despite unprecedented investments in secure coding practices, automated fuzzing, and bug bounty programs by the world’s largest technology conglomerates, defending complex software ecosystems remains an extraordinarily difficult uphill battle.

Andrew Whaley, Senior Technical Director at Promon, a Norwegian application security firm, noted that the ubiquity of smartphones and the profound reliance that modern society places on mobile devices make vulnerabilities in iOS and Android particularly perilous.

"While we all rely heavily on our mobile devices for everything from banking to communication, they are simply not invulnerable," Whaley stated. "As users, we need to maintain our guard just as diligently as we do on desktop operating systems. The responsibility, however, does not rest solely on the end-user or the operating system vendor."

Whaley emphasized that application developers—particularly those building high-risk applications such as mobile banking platforms, healthcare portals, and enterprise productivity tools—must adopt a defense-in-depth philosophy. By integrating an extra layer of application-level security controls, developers can ensure that their software does not rely exclusively on the underlying operating system for protection. According to Whaley’s industry experience, this crucial defensive layer is frequently overlooked, leaving end-users vulnerable even when operating systems are patched.

The Chronology of Apple’s 2022 Zero-Day Disclosures

To understand the frequency and severity of these threats, it is necessary to examine Apple’s vulnerability disclosure timeline over the course of the year.

In February 2022, Apple released iOS 12.5.5 and updates to iOS 15 to address critical WebKit and kernel flaws that were actively exploited. This pattern repeated in March, when Apple issued patches for two additional zero-days affecting the Intel Graphics Driver and AppleAVD, both of which allowed attackers to execute arbitrary code with kernel privileges.

As the year progressed, the cadence of zero-day discoveries remained steady. In May, Apple patched another kernel vulnerability (CVE-2022-22675) tied to an AppleAVD out-of-bounds write issue. The August release of iOS 15.6.1 and macOS Monterey 12.5.1 marks the latest in this ongoing series of urgent security interventions. Cybersecurity analysts point out that as attackers find traditional desktop perimeters increasingly fortified, the lucrative market for mobile exploits—driven by both commercial spyware vendors and state-backed cyber-espionage units—continues to fuel aggressive research into Apple’s ecosystem.

Practical Steps for Mitigation and Enterprise Defense

In response to the active exploitation of CVE-2022-32894 and CVE-2022-32893, security operations centers (SOCs) and IT administrators worldwide have accelerated device inventory audits to ensure rapid deployment of the patches.

For individual consumers, updating devices is a straightforward process:

1. Navigate to the Settings application on the iPhone or iPad.
2. Select General, then tap Software Update.
3. Download and install iOS 15.6.1 or iPadOS 15.6.1.
4. For Mac users, navigate to System Preferences via the Apple menu, select Software Update, and install macOS Monterey 12.5.1 or any subsequent security responses provided by Apple.

For enterprise environments, mobile device management (MDM) administrators are urged to enforce compliance policies that block non-compliant devices from accessing corporate networks until the necessary firmware updates are verified. Furthermore, security teams should monitor network traffic for anomalous outbound connections, unexpected data exfiltration, or unusual behavior in web-browsing applications that could indicate a compromised WebKit instance.

Conclusion and Future Outlook

The rapid discovery and weaponization of zero-day vulnerabilities in core operating system components and web engines underscore the relentless adaptability of modern threat actors. While Apple’s swift response in developing and issuing patches demonstrates the efficacy of modern vulnerability reporting pipelines, it also highlights the reactive nature of software security in an era of sophisticated cyber warfare.

As mobile devices continue to serve as the primary computing interface for billions of people globally, securing these platforms requires a collaborative effort spanning hardware vendors, software developers, application creators, and vigilant end-users. Until a paradigm shift occurs in how software is architected from the ground up, timely patching will remain the single most critical line of defense against the ever-present threat of device takeover and digital espionage.