Apple has issued an urgent warning to its entire iPhone user base — estimated at 1.8 billion devices worldwide — after identifying two critical security flaws that were actively exploited in what the company described as “an extremely sophisticated attack” against specific individuals and devices.
These warnings are serious and worth your attention, even if you don’t think you’re currently a target. Here’s what’s going on, what the risks are, and exactly what steps you need to take to protect your device and data.
What Apple Is Alerting Users About
Apple’s security advisory calls out two zero-day vulnerabilities in WebKit, the browser engine that powers Safari and all iOS browsers. Those flaws could allow attackers to execute malicious code on an iPhone or iPad simply by having a user visit a compromised website.
According to Apple:
-
The bugs were actively exploited in highly targeted attacks.
-
Attackers could potentially take control of the device or run code without user action beyond visiting a bad page.
-
Apple released emergency patches for iOS, iPadOS, macOS, and other device platforms to close these holes.
Although the company says that observed exploitation appears focused on particular targets rather than a mass campaign, the scope of the flaw means any unpatched device could become vulnerable if similar techniques are used broadly.
Why This Is Serious — Even if You’re Not a Target
Zero-day vulnerabilities are software bugs that attackers discover before the maker does, or before a patch is available. Because they are unknown to defenders until exploited, they are attractive to highly skilled attackers with resources and patience.
In this case:
-
WebKit runs on all iPhones, iPads, and many apps that render web content.
-
Exploiting a WebKit bug could let attackers run code without prompting the victim first.
-
That raises the risk of spyware installations, data theft, and deeper compromise.
Apple has not disclosed the identities of attackers or the victims, citing security concerns.
What You Need to Do Right Now
Install the latest software updates. That’s the most important step you can take.
-
Open Settings on your iPhone or iPad.
-
Navigate to General → Software Update.
-
Tap Download and Install if a new update is available.
Updating ensures your device includes the security patch that fixes the newly revealed vulnerabilities. Users with automatic updates enabled may already have the protections in place — but it’s still worth checking.
Extra Security Steps to Stay Safer
Updating is the first, essential step. You can also:
-
Avoid clicking links from unknown sources, even from messages that appear to come from friends.
-
Enable Lockdown Mode if you think you might be at elevated risk.
-
Review app permissions and revoke any access that seems unnecessary.
-
Keep software updated across your devices, including iPads and Macs.
-
Back up your device regularly so you can recover if something goes wrong.
These practices don’t replace updates, but they reduce the likelihood of exploitation through social engineering or compromised content.
Why Apple Issues These Warnings
Apple’s security team monitors real-world attacks and vulnerabilities closely. When they see evidence of active exploitation, they issue advisories to prompt users to update and protect themselves. This isn’t just good practice — it’s how serious security flaws are managed safely without giving attackers too much information before patches are available.
Even though the exploit Apple described was highly targeted toward specific individuals, the fact that it exists in a widely used component like WebKit means the underlying vulnerability could be misused more broadly if left unpatched.
Who Is Affected
All iPhones and iPads running older versions of iOS and iPadOS that have not yet installed the latest updates are potentially at risk. That includes many devices from recent generations — which makes this advisory relevant to nearly everyone running Apple mobile software.