This week, the technology giant made a mandatory update available to users of its mobile devices, aiming to mitigate recently identified severe digital security risks. The measure responds to the discovery of loopholes in the operating system’s navigation engine, which could allow remote control of devices by external agents and the compromise of sensitive data.
Cybersecurity experts identified that the flaws were being actively exploited before the manufacturer was even aware, characterizing what the industry classifies as “zero-day” threats. The fix arrives with the iOS 26.2, iPadOS 26.2 and macOS Sonoma 25.2 package, covering the brand’s entire product ecosystem.
The urgency of the update is due to the nature of the attack, which uses web content processing to infiltrate malicious code into terminals. Usuários are advised to check their device settings immediately and proceed with the installation of new software to ensure the integrity of their personal and corporate information.
Technical details of the fixed vulnerabilities
The focus of the update lies in fixing two specific issues cataloged as CVE-2025-42731 and CVE-2025-42824. Ambos affect WebKit, the engine that powers the Safari browser and serves as the basis for displaying web content in several other system applications. The flaw allowed the simple loading of a malicious web page or image to trigger the execution of unauthorized scripts.
The first vulnerability made it possible to execute arbitrary code, which means that an attacker could run commands on the victim’s device without any direct interaction other than accessing the contaminated content. Isso opens the door to installing spyware, stealing banking credentials, and monitoring communications in real time.
The second flaw fixed was related to the device’s memory management. By exploiting this error, hackers were able to bypass the operating system’s native protections, elevating their access privileges. The combination of these two loopholes created an ideal scenario for sophisticated and silent attacks.
High-profile targets and digital espionage
The discovery of these vulnerabilities was attributed to internal researchers and Grupo of Análise of Ameaças of Google (TAG), known for tracking state-sponsored espionage operations and commercial surveillance companies. The pattern of attacks suggests the use of high-cost tools, similar to the Pegasus software, generally used against specific targets of great strategic value.
Journalists, human rights activists, diplomats and executives from large corporations make up the primary profile of victims of these exploits. Diferente of common viruses that seek to reach the largest number of people, these tools are surgical and seek to extract confidential information from individuals who hold sensitive data or political influence.
Agência of Segurança Cibernética and Infraestrutura (CISA) quickly added these flaws to their catalog of exploited vulnerabilities, issuing an alert for government agencies and private companies to prioritize updating their technology parks. The coordinated action reinforces the severity of the incident in the global information security scenario.
Compatible Devices and Lock Mode
The update covers a wide range of devices still in circulation on the market. Apple ensured that the security patch was compatible with models released in recent years, ensuring that the user base is not left unprotected. Compatibility list includes:
– Toda the iPhone 16 line (standard models, Plus and Pro);
– Família iPhone 15 and its variations;
– Modelos of the iPhone 13 and 14 generations;
– Dispositivos older ones like iPhone 11 and 12;
– iPhone SE (2nd generation onwards).
For users who consider themselves at extreme risk from targeted digital attacks, the company recommends enabling “Bloqueio Mode” (Mode Lockdown). Esta functionality severely restricts certain system operations, such as previewing attachments and complex web technologies, creating an additional barrier against sophisticated intrusion attempts.
Installing iOS 26.2 can be done by accessing the Ajustes menu, navigating to the “General” section and selecting “Software Update”. It is recommended that the device is connected to a stable Wi-Fi network and has a battery above 50% to avoid interruptions during the installation process.
Keywords: iOS 26.2, iPhone security, WebKit flaw, Apple update.
Long-tail keyword: how to protect iPhone against spyware and zero-day failures.
Sources researched:
https://support.apple.com/en-us/HT201222
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://blog.google/threat-analysis-group/