Apple says iOS 14.4 fixes three security bugs ‘actively exploited’ by hackers

Apple has released iOS 14.4 with security fixes for three vulnerabilities, said to be under active attack by hackers.

The technology giant said in its security update pages for iOS and iPadOS 14.4 that the three bugs affecting iPhones and iPads may have been actively exploited." Details of the vulnerabilities are scarce, and an Apple spokesperson declined to comment beyond what's in the advisory.

It's not known who is actively exploiting the vulnerabilities, or who might have fallen victim. Apple did not say if the attack was targeted against a small subset of users or if it was a wider attack. Apple granted anonymity to the individual who submitted the bug, the advisory said.

Two of the bugs were found in WebKit, the browser engine that powers the Safari browser, and the Kernel, the core of the operating system. Some successful exploits use sets of vulnerabilities chained together, rather than a single flaw. It's not uncommon for attackers to first target vulnerabilities in a device's browsers as a way to get access to the underlying operating system.

Apple said additional details would be available soon, but did not say when.

It's a rare admission by Apple, which prides itself on its security image, that its customers might be under active attack by hackers.

In 2019, Google security researchers found a number of malicious websites laced with code that quietly hacked into victims' iPhones. TechCrunch revealed that the attack was part of an operation, likely by the Chinese government, to spy on Uyghur Muslims. In response, Apple disputed some of Google's findings in an equally rare public statement, for which Apple faced more criticism for underplaying the severity of the attack.

Last month, internet watchdog Citizen Lab found dozens of journalists had their iPhones hacked with a previously unknown vulnerability to install spyware developed by Israel-based NSO Group.

In the absence of details, iPhone and iPad users should update to iOS 14.4 as soon as possible.

Dozens of journalists' iPhones hacked with NSO zero-click' spyware, says Citizen Lab