Talos reported WebKit flaws in WebKit that allow Remote Code Execution
60
60
60
60
60
60
60
60
Apple Releases Urgent iPhone and iPad Updates to Patch New Zero
60
60
60
Apple Releases Urgent 0-Day Bug Patch for Mac, iPhone and iPad Devices
60
Apple Issues Urgent Patches for 2 Zero
60
WebKit Under Attack: Apple Issues Emergency Patches for 3 New Zero
60
60
Apple Fixes WebKit Vulnerability Enabling Same
60
60
Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild
60
60
Apple backports fix for exploited WebKit bug to older iPhones, iPads (CVE-2023-23529)
60
60
Week in review: KeePass vulnerability, Apple fixes exploited WebKit 0-days
60
60
Apple released patches for recently disclosed WebKit zero
60
Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit
60
60
60
Apple fixes actively exploited WebKit zero-day (CVE-2024-23222)
60
Apple fixes four zero-days under attack
60
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.
75
60
60
New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products
60
60
Apple addresses three zero
60
60
60
Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities
Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.
Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.
68
Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI
60
Coruna: Spy-grade iOS exploit kit powering financial crime
60