Apple fixes zero-day flaws in WebKit for sophisticated attacks

Apple has addressed two zero-day vulnerabilities in its WebKit engine that were exploited in sophisticated attacks. The company released patches to fix these bugs, enhancing security for users of its devices.

Apple announced fixes for two zero-day flaws in WebKit, the engine powering Safari and other web technologies on its platforms. These vulnerabilities were actively exploited in what the company described as sophisticated attacks, posing risks to user data and device integrity.

The patches were issued as part of Apple's regular security updates, targeting iOS, iPadOS, macOS, and other affected systems. WebKit's role in rendering web content makes it a frequent target for attackers seeking to execute malicious code.

No specific details on the nature of the exploits or affected users were provided in the announcement, but Apple emphasized the importance of updating devices promptly to mitigate risks. This move underscores ongoing efforts to counter advanced cyber threats in the ecosystem.

Related Articles

Apple began rolling out iOS 26.2 on December 12, 2025, patching two zero-day WebKit vulnerabilities actively exploited in sophisticated targeted attacks, plus over two dozen other bugs. The update adds UI improvements like expanded Liquid Glass customization and app features for Apple Music, Podcasts, and more. Companion updates for iPadOS, macOS, watchOS, tvOS, and visionOS focus on convenience and security. At least half of iPhone owners have yet to update to iOS 26 or later, risking exposure.

Reported by AI

Apple has released iOS 26.3.1 (a), described as its first Background Security Improvement, to address a WebKit issue on iPhones. The update targets the engine powering Safari and third-party browsers. Apple urges all users to install it.

Veeam has addressed three critical-severity security vulnerabilities that could expose backup servers to remote code execution attacks. The company issued patches to mitigate these risks. The announcement highlights ongoing concerns in cybersecurity for data protection tools.

Reported by AI

Cisco Talos has detailed how a Chinese-linked group is exploiting an unpatched zero-day in email security appliances since late November 2025, deploying backdoors and log-wiping tools for persistent access.

 

 

 

This website uses cookies

We use cookies for analytics to improve our site. Read our privacy policy for more information.
Decline