Apple on Monday pushed out major security-themed updates to its flagship iOS, macOS and iPadOS platforms, warning that at least one of the patched vulnerabilities has already been exploited in the wild.
The Cupertino device maker announced patches for critical code execution flaws in iOS and macOS, including a kernel bug that was used in an exploit chain documented by Russian anti-malware vendor Kaspersky.
According to Apple, the kernel flaw (CVE-2023-38606) affects both iOS, iPadOS and macOS-powered devices and was already actively exploited against versions of iOS released before iOS 15.7.1.
“An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited,” the company confirmed, crediting five different Kaspersky researchers with reporting the issue.
This is the second time Apple has pushed out fixes for software defects exploited as part of APT-style attacks on Kaspersky’s corporate network. Kaspersky’s disclosure came on the same day Russia’s Federal Security Service (FSB) blamed US intelligence agencies for an ongoing spy campaign targeting thousands of iOS devices belonging to domestic subscribers and foreign diplomatic missions.
In all, Apple fixed at least 25 documented security bugs haunting iPhones and iPads, including multiple issues that expose mobile devices to code execution attacks. The iOS 16.6 update also covers a WebKit bug that was first addressed in the recent Rapid Security Response rollout.
Apple also fixed security issues in its Safari browser (Safari 16.6), older versions of iPhones and iPads (iOS 15.7.8 and iPadOS 15.7.8), and macOS Ventura 13.5.
Related: Russia Blames US Intelligence for iOS Zero-Click Attacks
Related: Apple Denies Helping US Government Hack Russian iPhones
Related: Apple Patches iOS Flaws Used in Kaspersky ‘Operation Triangulation’
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
- CrowdStrike to Acquire Application Intelligence Startup Bionic
- HiddenLayer Raises Hefty $50M Round for AI Security Tech
- Microsoft AI Researchers Expose 38TB of Data, Including Keys, Passwords and Internal Messages
- Extradited Russian Hacker Behind ‘NLBrute’ Malware Pleads Guilty
- Caesars Confirms Ransomware Hack, Stolen Loyalty Program Database
- AuthMind Scores $8.5M Seed Funding for ITDR Tech
- Zero-Day Summer: Microsoft Warns of Fresh New Software Exploits
Latest News
- Microsoft Adding New Security Features to Windows 11
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Sony Investigating After Hackers Offer to Sell Stolen Data
- The CISO Carousel and its Effect on Enterprise Cybersecurity
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
