What happened
Apple has released updates for iOS and macOS, addressing a total of 286 vulnerabilities in version 27.2. One of these vulnerabilities involved a zero-day flaw in CoreGraphics, which was actively exploited in the wild prior to the patch being issued. The fix for this zero-day has been backported to older iPhones running iOS 18. The updates did not include specific CVE identifiers or CVSS scores, but the vulnerabilities collectively are considered of medium severity. The exploitation was confirmed to be active at the time of the patch release, indicating ongoing risks for affected users.
Who is affected
Organisations running affected versions of Apple iOS and macOS are impacted by this security update. The vulnerabilities affect devices operating on iOS and macOS 27.2, as well as older iPhones still supported by iOS 18. The vulnerabilities could potentially allow an attacker to compromise device security, particularly through exploitation of the affected CoreGraphics component. While the exact scope of affected devices is not specified, any deployment using these Apple operating systems is considered vulnerable to the exploited flaw until patched.
Recommended actions
- Apply the latest updates for Apple iOS 27.2 and macOS 27.2 to mitigate the vulnerabilities, including the actively exploited zero-day in CoreGraphics.
- Ensure that devices running older versions, such as iOS 18, receive the backported fix for the zero-day flaw to prevent exploitation of that vulnerability.
- Continuously monitor for indicators of compromise related to the exploited zero-day, particularly in environments with users or assets that may be targeted by malicious actors exploiting the flaw.
