Researchers say they found two iPhone 0-days, exploited in the wild, including a remote zero-click vulnerability; Apple says both will be patched in an update
In the summer of 2016, researchers at a digital rights organization and a cybersecurity firm announced they had caught …
Context & Ripple Effects
This is the second time researchers have caught iPhone zero-days being used against real targets: in 2016, flaws used to try to remotely steal data from activists were traced to malware vendor NSO and patched in iOS 9.3.5. The new disclosure follows the same shape — two actively exploited vulnerabilities present since at least iOS 6, one of them a remote zero-click flaw in Mail that needs no user interaction.
The arc matters because disclosure-to-patch has been uneven: a researcher later reported three zero-days still exploitable in iOS 15 despite being reported to Apple months earlier, and by late 2023 Apple was shipping emergency updates for two more zero-days, its twentieth of that year alone.
First-order effects
- iPhone and iPad users running vulnerable iOS versions are exposed right now, particularly through the Mail app's zero-click path, until Apple ships the promised update.
- Apple must fast-track a security release outside its normal cadence, as it did with the 2016 iOS 9.3.5 patch and the 2023 emergency updates.
Second-order effects
- Surveillance vendors such as NSO, whose exploits powered the 2016 activist attacks, lose working entry points once the patch lands and are pushed toward newly discovered or undisclosed chains.
- Security teams treating iOS as low-risk have to re-evaluate, since a zero-click remote flaw removes the phishing-link defense that most mobile guidance relies on.
Third-order effects
- If the pattern holds — exploited-in-the-wild iOS zero-days surfacing repeatedly from 2016 through 2023 — Apple faces structural pressure to shorten disclosure-to-patch windows and shrink the attack surface of pre-installed apps like Mail.
- The commercial market for offensive iOS exploits stays durable enough that each patch is less an endpoint than a rotation point for buyers of new chains.
The trend: iOS zero-day exploitation has become a recurring feature of the threat landscape since the 2016 NSO-era disclosures, with Apple's emergency patch releases turning into a standing response rather than an exception.