Apple released an emergency security update, iOS 26.2, this Monday, December 29, 2025, to fix critical vulnerabilities that were being actively exploited by attackers. The company warned that the breaches, known as “zero days”, allowed malicious code to be executed remotely, compromising data security on iPhones and other branded devices.
The main focus of the patch package is on WebKit, the engine that powers the Safari browser and other internet-enabled applications in the company’s ecosystem. The flaws allowed cybercriminals to gain control over devices without the need for any action on the part of the user, posing a significant risk to personal and financial information.
Due to the seriousness of the situation, the manufacturer’s recommendation is that all owners of compatible devices install the new software immediately. The update aims to shield the system against attacks that were already underway, neutralizing the main gateway used by malicious agents.
Zero-day vulnerabilities and risks to users
The two main flaws have been officially cataloged as CVE-2025-43529 and CVE-2025-14174. A “zero-day” vulnerability is particularly dangerous because it refers to a security hole that is discovered and exploited by hackers before the software developer himself is aware of it. Isso creates a window of opportunity for targeted attacks as there are no defenses or fixes available to the general public.
In the specific case of iOS 26, attackers used malicious websites to deliver corrupted data packets. When processed by WebKit, this data caused a memory overflow (buffer overflow), allowing the execution of arbitrary codes. Esse method paved the way for the installation of spyware, spy software capable of monitoring all user activities, including messages, calls, location and access to sensitive files.
Direct impact on the WebKit engine and mobile browsing
WebKit is the heart of internet browsing on all Apple products, being a mandatory component for any browser available on the App Store. Essa centralization means that a vulnerability in its core affects not only Safari, but also third-party applications like Chrome and Firefox running on iOS. The fix implemented in iOS 26.2 improves memory management and introduces stricter data validation to prevent exploitation of these holes. The ability to execute malicious code with elevated privileges could allow an attacker to take full control of the operating system by accessing the kernel, which is the most fundamental part of the software. To mitigate this risk, the new security patch strengthens process isolation, a technique that prevents a compromised tab or application from accessing restricted areas of the system or data from other applications, creating more robust digital barriers to protect the integrity of the device.
Compatible devices and released security versions
Apple has ensured that protection extends to a wide range of its products, not just limited to the latest models.
For older devices that do not support iOS 26, iOS 18.7.3 and iPadOS 18.7.3 were made available, ensuring that a larger user base was not exposed.
The product line that received the update includes iPhones from model 15 onwards, all iPad models Pro and Air, computers with macOS Tahoe 26.2 and even Apple Watch and visionOS.
Necessary procedures for data protection
To install the security update, users must go to the “Settings” app, select the “General” option, and then tap “Software Update.”
The device will automatically check the availability of the new package. It is recommended to be connected to an Wi-Fi network and have at least 50% battery so that the process can occur without interruptions.
Manually searching for the update is the fastest way to ensure protection, as automatic distribution may take a few days to reach all devices globally.
The sophisticated nature of the attacks reinforces the importance of keeping the operating system always up to date, as this is the main defense barrier against cyber threats.
History of sophisticated attacks using spyware
Using zero-day flaws to plant spyware on mobile devices has become a common tactic for digital espionage groups and government agencies. Essas vulnerabilities are highly valued on the underground market, and can cost millions of dollars due to their potential for access to confidential information. Apple has a history of responding quickly to these incidents, often releasing fixes within hours or a few days of confirming an active exploit, as occurred in this case.
The rapid identification and correction of loopholes in iOS 26 were crucial to prevent attacks from spreading on a large scale, protecting millions of users from phishing campaigns and the silent installation of malware. Memory management, the core of the CVE-2025-43529 flaw, continues to be one of the most challenging areas in developing secure operating systems, requiring continuous vigilance and testing by engineers to anticipate and neutralize new intrusion techniques.
Additional security measures and integrity check
In addition to installing the update, Apple suggests that users who may be high-risk targets, such as activists, journalists, and politicians, consider enabling “Bloqueio Mode.” Esse feature severely restricts device functionality, such as message attachments and certain web technologies, to drastically reduce the attack surface that can be exploited by hackers.
With the new software, integrity checking has been strengthened. Agora, each content loaded by WebKit undergoes digital signature validation before being processed. Essa change, although transparent to the user, adds a fundamental security layer that prevents unauthorized scripts from running and ensures that device performance is not affected by malicious processes operating in the background.
