Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware

https://www.theregister.com/2026/02/12/apple_ios_263/

by beardyw • 5 months ago

267 219 5 months ago

theregister.com

cpncrunch2• 5 months ago

No updates for ipados17. I guess my ipad pro 10.5 is finally a brick.

cmurf• 5 months ago

Feudalism says: buy new hardware, peasant.

I don't know what "equally annoying" would be for a company and its customers, i.e. a fair compromise. But we need a law requiring companies open source their hardware within X days of end of life support.

And somehow make sure these are meaningful updates. Not feature parity with new hardware, but security parity when it can be provided by a software only update.

Otherwise a company in effect takes back the property, without compensation.

cpncrunch2• 5 months ago

The battery has very little capacity now, so I'm planning on buying a new iPad air with the M chip. It's really a game changer in terms of performance and efficiency.

brainzap• 5 months ago

I am shocked to hear that over these years it was possibl to extract data from a locked iphone. (hardening mode off)

I trusted apple.

gruez5• 5 months ago

I trusted apple.

To what? Write 100% bug free software? I don't think that's actually achievable, and expecting so is just setting yourself up for appointment. Apple does a better job than most other vendors except maybe GrapheneOS. Mainstream Android vendors are far worse. Here's Cellebrite Premium's support matrix from July 2024, for locked devices. iPhones are vulnerable after first unlock (AFU), but Androids are even worse. They can be hacked even if they have been shut down/rebooted.

https://grapheneos.social/system/media_attachments/files/112...

fsflover8• 5 months ago

Qubes OS does a much better job though, because it relies on security through compartmentalization, not security through correctness.

RankingMember• 5 months ago

These links working for anyone? 403 for me

CharlesW• 5 months ago

This is a newly-discovered vulnerability (CVE-2026-20700, addressed along with CVE-2025-14174 and CVE-2025-43529).

Note that the description "an attacker with memory write capability may be able to execute arbitrary code" implies that this CVE is a step in a complex exploit chain. In other words, it's not a "grab a locked iPhone and bypass the passcode" vulnerability.

jrmg• 5 months ago

I may well be missing something, but this reads to me as code execution on user action, not lock bypass.

Like, you couldn’t get a locked phone that hadn’t already been compromised to do anything because it would be locked so you’d have no way to run the code that triggers the compromise.

Am I not interpreting things correctly?

[edit: ah, I guess “An attacker with memory write capability” might cover attackers with physical access to the device and external hardware attached to its circuit board that can write to the memory directly?]

saagarjha14• 5 months ago

No your original analysis is fine

j16sdiz• 5 months ago

What does "zero-day" even meant?

... decade-old ...
... was exploited in the wild ...
... may have been part of an exploit chain....

gruez5• 5 months ago

https://en.wikipedia.org/wiki/Zero-day_vulnerability

buttscicles• 5 months ago

Meaning unknown to the public/vendor

runjake2• 5 months ago

“Zero day” has meant different things over the years, but for the last couple-ish decades it’s meant “the number of days that the vendor has had to fix them” AKA “newly-known”.

EvanAnderson2• 5 months ago

It still weirds me out that a term w@r3z d00dz from the 90s coined is now a part of the mainstream IT security lexicon.

alanbernstein• 5 months ago

Well whatever the zero means, it can't be the number of days that the bug has been present, generally. It should be expected that most zero-days concern a bug with a non-zero previous lifespan.

CSMastermind• 5 months ago

The vulnerability has been present for more than a decade.

There is evidence that some people were aware and exploiting it.

Apple was unaware until right now that it existed, thus is a 'zero day' meaning an exploit that the outside world knows about but they don't.

saagarjha14• 5 months ago

I don’t see any evidence it was there for a decade

zero0529• 5 months ago

I guess the fix is only for Tahoe?

Edit: I meant iOS 18

bzzzt• 5 months ago

There's an update for Sequoia too.

cluckindan• 5 months ago

But not for iOS 18, so this is a forced upgrade to the horrors of Liquid Glass.

Can’t wait to see how much battery it eats.

MYEUHD2• 5 months ago

The zero-day mentioned in the article doesn't affect macOS.

But there were security updates for macOS 14 and macOS 15 released yesterday:

https://support.apple.com/en-us/126350

https://support.apple.com/en-us/126349

asah• 5 months ago

Open source wins... again.

saagarjha14• 5 months ago

Unfortunately it doesn’t actually

baq3• 5 months ago

as in I now have to upgrade all my children's ancient iphones...?

I'd much rather not do that

kstrauser2• 5 months ago

You’d rather they not release updates to support them?

baq3• 5 months ago

I'd rather they did so I don't have to upgrade

edit: my original post wasn't clear I see - I meant I don't want to ditch the phones they've got and hope Apple releases an update for ios 16

alt2273• 5 months ago

Why cant they just release security patches for older versions of iOS instead of forcing to upgrade version?

lagadu• 5 months ago

The exploit was always there, you just didn't know about it, but attackers might have. The only thing that changed is that you're now aware that there's a vulnerability.

samtheprogram• 5 months ago

And now everyone else is aware of it too... including anyone marginally above a scriptkiddie.

max_3• 5 months ago

My suspicion is that. These "exploits" are planted by spy agencies.

They don't appear there organically.

bell-cot• 5 months ago

Maybe sometimes? With how many bugs are normally found in very complex code, would a rational spy agency spend the money to add a few more? Doing so is its own type of black op, with plenty of ways to go wrong.

OTOH, how rational are spy agencies about such things?

max_3• 5 months ago

Yes. Of course not all.

But some just happen to work too well.

But governments do have blatant back doors in chips & software.

2OEH8eoCRo0• 5 months ago

Some suspect that Apple secretly backs some of these spyware services. I've heard rumors about graykey but only rumors. Thoughts?

gruez5• 5 months ago

Some suspect ...
I've heard rumors ...

So like, the comment you're replying to? This is just going in circles.

zappb• 5 months ago

This vastly overstates both the competence of spy agencies and of software engineers in general. When it comes to memory unsafe code, the potential for exploits is nearly infinite.

xnx• 5 months ago

overstates both the competence of spy agencies

Stuxnet was pretty impressive: https://en.wikipedia.org/wiki/Stuxnet

kenferry• 5 months ago

This kind of mental model only works if you think of things as made huge shadowy blobs, not people.

dyld has one principal author, who would 100% quit and go to the press if he was told (by who?) to insert a back door. The whole org is composed of the same basic people as would be working on Linux or something. Are you imagining a mass of people in suits who learned how to do systems programming at the institute for evil?

Additionally, do you work in tech? You don’t think bugs appear organically? You don’t think creative exploitation of bugs is a thing?

max_3• 5 months ago

I am not saying this one in particular.

Of course no one can admit it publicly.

But it is something that governments are known to proactively do.

You can get dirt on people a la Jeffrey Epstein. And use that to coerce them.

https://en.wikipedia.org/wiki/Backdoor_(computing)

saagarjha14• 5 months ago

dyld has several people working on it now AFAIK

meisel• 5 months ago

I wonder what the internal conversations are like around memory safety at Apple right now. Do people feel comfortable enough with Swift's performance to replace key things like dyld and the OS? Are there specific asks in place for that to happen? Is Rust on the table? Or does C and C++ continue to dominate in these spaces?

gsnedders• 5 months ago

While not wholesale replacing it, there already is Swift in dyld: https://github.com/search?q=repo%3Aapple-oss-distributions%2...

saagarjha14• 5 months ago

This goes into dyld.framework, not dyld the linker

ronsor• 5 months ago

Apple is already working on a memory-safe C variant which is already used in iBoot and will be upstream LLVM soon: https://clang.llvm.org/docs/BoundsSafety.html

ChrisArchitect• 5 months ago

Previously: https://news.ycombinator.com/item?id=46979643

erichocean• 5 months ago

I wonder if Fil-C would have prevented this.

bigyabai• 5 months ago

Doubtful, Apple is one of the largest advocates of safe C already.

dudeinhawaii• 5 months ago

So the exploiters have deprecated that version of spyware and moved on I see. This has been the case every other time. The state actors realize that there's too many fingers in the pie (every other nation has caught on), the exploit is leaked and patched. Meanwhile, all actors have moved on to something even better.

Remember when Apple touted the security platform all-up and a short-time later we learned that an adversary could SMS you and pwn your phone without so much as a link to be clicked.

KSIMET: 2020, FORCEDENTRY: 2021, PWNYOURHOME, FINDMYPWN: 2022, BLASTPASS: 2023

Each time NSO had the next chain ready prior to patch.

I recall working at a lab a decade ago where we were touting full end-to-end exploit chain on the same day that the target product was announcing full end-to-end encryption -- that we could bypass with a click.

It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary.

mmmlinux• 5 months ago

Thanks for contributing to our increasing lack of security and anonymity.

avazhi9• 5 months ago

Meh. It’s up to Apple to write secure software in the first place. Maybe if they spent more time on that instead of fucking over their UI in the name of something different, and less time virtue signalling, their shit would be more secure.

vonneumannstan• 5 months ago

It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary.

I hate these lines. Like yes NSA or Mossad could easily pwn you if they want. Canelo Alvarez could also easily beat your ass. Is he worth spending time to defend against also?

high_na_euv• 5 months ago

Yes, because Apple can do it at scale.

Eridrus• 5 months ago

Yes. If vendors do not take this seriously, these capabilities trickle down to less sophisticated adversaries.

UqWBcuFx6NV4r2• 5 months ago

You’re missing the point. If they don’t believe that they’re targeted, how are they going to be able to LARP online?

whitepoplar3• 5 months ago

How much do you think Lockdown Mode + MIE/eMTE helps? Do you believe state actors work with manufacturers to find/introduce new attack vectors?

walterbell29• 5 months ago

My iOS devices have been repeatedly breached over the last few years, even with Lockdown mode and restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator. Since moving to 2025 iPad Pro with MIE/eMTE and Apple (not Broadcom & Qualcomm) radio basebands, it has been relatively peaceful. Until the last couple of weeks, maybe due to leakage of this zero day and PoC as iOS 26.3 was being tested.

8cvor6j844qw_d6• 5 months ago

Do you believe state actors work with manufacturers to find/introduce new attack vectors?

Guaranteed. I find it hard to believe state actors will not attempt this.

Flash paper is king when it comes to secrets I guess.

varispeed3• 5 months ago

and if you point out that Apple's approach is security by obscurity with a dollop of PR, you get downvoted by fan bois.

Apple really need to open up so at very least 3rd parties can verify integrity of the system.

wat100003• 5 months ago

They shipped MTE on hundreds of millions of devices. Is that security by obscurity or PR?

blackoil• 5 months ago

Theoretical question. How much more secure will be a Linux device which uses phone as a dumb Internet provider.

baq3• 5 months ago

Linux is swiss cheese and your dumb phone is probably full of zero days which will happily mitm you.

fsflover8• 5 months ago

If you care about security, you should try Qubes OS.

digiown3• 5 months ago

Linux has few defenses against the compromise of individual programs leading to the whole system being compromised. If you stick to basic tools (command line) that you can fully trust, it might be somewhat resistant to these types of attacks. The kernel might be reasonably secure but in typical setups, any RCE in any program is a complete compromise.

Things like QubesOS can help, but it's quite high-effort to use and isn't compatible with any phone I know of.

octoberfranklin• 5 months ago

It would at least be diverse.

fweimer• 5 months ago

There is one non-technical countermeasure that Apple seems unwilling to try: Apple could totally de-legitimize the secondary access market if they established a legal process for access their phones. If only shady governments require exploits, selling access to exploits could be criminalized.

9cb14c1ec0• 5 months ago

It would not completely de-legitimize it. Maybe a government doesn't want anyone to know they are surveilling a suspect. But it definitely would reduce cash flow at commercial spyware companies, which could put some out of business.

ikmckenz• 5 months ago

Your opinion is that Apple should have just handed over Jamal Khashoggi‘s information to the Saudi Arabian agents who were trying to kill him, because then Saudi Arabia wouldn’t have been incentivized to hack his phone? I think you’ll find most people’s priorities differ from yours.

saagarjha14• 5 months ago

As many people in this space have found out recently, there is no real thing as a non-shady government.

digiown3• 5 months ago

We have a word for this: a backdoor. It wouldn't de-legitimize the secondary access market. It would just delegitimize Apple itself to the same level. Apple seems to care about its reputation as the defender of privacy, regardless of how true it is in practice, and providing that mechanism destroys it completely.

walterbell29• 5 months ago

Did MIE/MTE on 2025 iPhones help to detect this longstanding zero day?

shantara2• 5 months ago

Meanwhile Apple made a choice to leave iOS 18 vulnerable on the devices that receive updates to iOS 26. If you want security, be ready to sacrifice UI usability.

argsnd3• 5 months ago

If you set Liquid Glass to the more opaque mode in settings I find iOS usability to be fine now, and some non-flashy changes such as moving search bars to the bottom are good UX improvements.

The real stinker with Liquid Glass has been macOS. You get a half-baked version of the design that barely even looks good and hurts usability.

microtonal2• 5 months ago

Still takes multiple taps to find something on a page in Safari.

JensenTorp2• 5 months ago

iOS 26 is a disaster on devices with 4GB RAM though, so I'm not upgrading my iPhone 13 Mini again (that was a traumatic few days).

Someone12343• 5 months ago

Apple released iOS 18.7.5:

https://support.apple.com/en-us/126347

supernes• 5 months ago

18.7.3 and newer are not published for most devices that support them in order to coerce people to move to 26.x

shantara2• 5 months ago

Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation

burnt-resistor2• 5 months ago

It's a rug-pull going against the tradition of supporting the most recent 2 OS versions until the autumn refresh simply to technofascistly force users onto 26 with an artificially-created Hobson's false choice between security and usability. This is bullshit.

MYEUHD2• 5 months ago

No.

They have been doing this every year for the past several years: https://www.macrumors.com/2025/12/19/ios-18-forced-ios-26-up...

It's being noticed just now because iOS 26 has controversial UI/UX and many users don't want to update.

halJordan• 5 months ago

I'll never understand how people actually believe that their refusal to adapt, and refusal opening them up to harm, is ever not their own fault

You're choosing to not have the update. And that's fine- own it.

prodigycorp• 5 months ago

What's never mentioned in posts like this is whether phones in lockdown mode were vulnerable too.

jl6• 5 months ago

Oh great, so is this how Apple forces me to downgrade from iOS 18 to iOS 26?

Towaway693• 5 months ago

That was my first thought. No backports for older devices?

So left to update to 26.3, device slows, battery life deteriorates and a new device needs to be ~~purchased~~ … errr rented.

Good that apple has a monopole else consumers would have a choice.

fsflover8• 5 months ago

There is a choice. Sent from my GNU/Linux phone Librem 5.

j453• 5 months ago

It's pretty unbeliveable that a zero-day can sit here this long. If one can exist, the likeliehood of more existing at all times is non-trivial.

Whether it's a walled garden of iOS, or relative openneds of Android, I don't think either can police everythign on anyone's behalf.

I'm not sure how organizations can secure any device ios or android if they can't track and control the network layer, period out of it, and there are zero carveouts for the OS itself around network traffic visibility.

walterbell29• 5 months ago

how organizations can secure any device ios or android if they can't track and control the network layer, period out of it, and there are zero carveouts for the OS itself around network traffic visibility.

The closest I've seen is an on-device VPN like Lockdown Privacy , but it can't block Apple bypassing the VPN.

https://lockdownprivacy.com/ | https://github.com/confirmedcode/Lockdown-iOS

Melatonic6• 5 months ago

Or the tiny CPU on the networking hardware chip

ThinkBeat• 5 months ago

You cannot.

iOS is one problem, but it goes for every other device/server/desktop/appliance that you use.

You can take a lot of precautions, and mitigate some risk, and ensure that operations can continue even if something bad happens¹, but you cant ever "be safe".

¹ "" There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don't know we don't know "" (Often attributed to Donald Rumsfeld, though he did not originate the concept.)

Know what bad can happen is difficult.

fsflover8• 5 months ago

Except Qubes OS, which often saves you even when an unknown unknown happens.

saagarjha14• 5 months ago

How do you expect to catch this with network traffic analysis?

JensenTorp2• 5 months ago

Outrageous that this isn't being patched in iOS 18. Genuinely shocked, and indefensible.

p-t• 5 months ago

i wonder if this could be used to make a jailbreak possible :3

burnt-resistor2• 5 months ago

Submit feedback (or radar equivalents) to Apple about the nasty rug-pull of not patching 18 on all devices. Don't expect a response however.

https://www.apple.com/feedback

zerotolerance• 5 months ago

Apple has some of my favorite vulnerabilities, most notably GOTO Fail: https://www.imperialviolet.org/2014/02/22/applebug.html

riggsdk• 5 months ago

Whenever plugging a hole like this, the OS should kinda leave it “open” as a kind of honeypot and immediately show a warning to the user that some exploit was attempted. Granted, the malware will quickly adapt but you should at least give some users (like journalists or politicians) the insanely important information about them being targeted by some malicious group.

Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware

Related Stories