Apple Patches Decade-Old IOS Zero-Day, Possibly Exploited By Commercial Spyware

Slashdot

by EditorDavid

February 15, 2026

AI-Generated Deep Dive Summary

This week, Apple addressed a critical zero-day vulnerability in iOS and macOS, labeled CVE-2026-20700, which could be exploited for severe attacks such as information exposure, denial-of-service (DoS), file manipulation, network interception, and arbitrary code execution. The flaw was identified by Apple's security team and Google’s Threat Analysis Group, with evidence suggesting it might have been targeted by commercial spyware vendors to compromise specific individuals. The vulnerability stems from a memory corruption issue that could allow attackers to execute arbitrary code, leading to potential sandbox escapes and privilege escalation. It is linked to two other zero-day flaws patched earlier in WebKit—CVE-2025-14174 and CVE-2025-43529—which were exploited in similar attacks. These interconnected vulnerabilities highlight the sophistication of modern cyber threats, particularly those targeting high-profile individuals or organizations. Security expert Brian Milbier of Huntress described this patch as closing a door that had been open for over a decade, emphasizing its long-standing potential for exploitation. The discovery underscores the importance of vigilance in addressing such flaws promptly to prevent malicious actors from leveraging them for surveillance or espionage. For readers interested in tech and cybersecurity, this story highlights the critical role of patches and updates in safeguarding devices against advanced threats. While Apple has taken action by releasing security updates, users are encouraged to keep their systems updated to mitigate risks associated with zero-day exploits. This incident also raises awareness about the ongoing efforts to combat sophisticated spyware, which often targets specific individuals for espionage or data theft.

Verticals

tech

Originally published on Slashdot on 2/15/2026