Google warns about two iOS zero-day vulnerabilities that hackers have been actively exploiting; the vulnerabilities have been fixed in iOS 12.1.4 update
iOS users are advised to update to iOS 12.1.4; release which also fixes infamous FaceTime bug. — A Google top security engineer …
Context & Ripple Effects
This is an early data point in a pattern that keeps repeating across Apple's release history: outside researchers surface flaws already being used against iPhone users, and Apple ships an out-of-band fix. Here it is Google sounding the alarm on two actively exploited iOS zero-days, with the emergency iOS 12.1.4 release doubling as the fix for the infamous FaceTime bug.
The arc runs forward from here: Apple later patched three 0-days in the iOS 14.4 update, confirmed a WebKit zero-day found by Google in iOS 16.1.2 (actively exploited for remote code execution), and by December 2023 had logged twenty zero-days patched in a single year. Google appearing as both reporter and rival platform vendor is the notable wrinkle in this installment.
First-order effects
- iPhone users on unpatched devices are exposed to two vulnerabilities hackers were already using, making the iOS 12.1.4 update urgent rather than routine maintenance.
- Apple has to fold the FaceTime bug fix into the same emergency release, compressing its normal patch schedule around externally disclosed flaws.
Second-order effects
- Google's public warning sets a disclosure dynamic where a direct competitor effectively audits iOS security, raising the reputational cost for Apple when fixes lag active exploitation.
- Enterprise and security teams treating iOS as low-maintenance have to re-plan around unscheduled emergency updates rather than predictable release cycles.
Third-order effects
- If the pattern holds — and the corpus suggests it accelerates, from this 2019 pair to twenty zero-days patched in 2023 — emergency security patching becomes a standing operating mode for Apple rather than an exception, with discovery increasingly driven by outside firms like Google.
- Cross-platform vulnerability research by competing vendors hardens into a norm, pushing the industry toward faster coordinated disclosure and shorter exploit windows.
The trend: Apple's iOS security posture is shifting toward a continuous cycle of externally reported, actively exploited zero-days met with emergency patches, with Google among the most consistent finders.