In today's iOS 14.4 update, Apple fixes three 0-days, tipped by an anonymous researcher, and acknowledges a report that they may have been exploited in the wild

Fixes come after Apple patched another set of three zero-days last November. — Apple has released today security updates …

ZDNet 2021-01-27 Catalin Cimpanu

Context & Ripple Effects

Apple had already patched three zero-days in November, making iOS 14.4 a second consecutive disclosure involving multiple flaws and a possible real-world exploitation report. The anonymous tip also shows Apple acting on outside vulnerability research rather than a public attribution.

What followed turned that episode into a recurring security-maintenance pattern: by July, Apple had addressed another reportedly exploited zero-day across iOS, iPadOS, and macOS, and later releases continued to cite flaws that may have been exploited.

First-order effects

iOS 14.4 gives Apple users a patch for three zero-days, while Apple publicly acknowledges that the flaws may have been used in attacks.
The anonymous researcher’s report becomes an input to Apple’s vulnerability-response process, even though the researcher is not identified.

Second-order effects

Repeated reports of potentially exploited flaws increase Apple’s need to coordinate security releases across its operating systems, as later seen in updates that fixed two zero-days in iOS, iPadOS, and macOS.
The pattern makes rapid installation more consequential for Apple device users because reported exploitation can precede or accompany public disclosure.

Third-order effects

If this cadence persists, zero-day response becomes a standing cross-platform operating function for Apple rather than an occasional iOS maintenance event.
The later run of releases, including three zero-days patched across four Apple platforms, points toward security update speed and scope becoming a more visible measure of platform stewardship.

The trend: Apple’s security maintenance is moving toward recurring, coordinated responses to reported zero-days across its device operating systems.

Discussion

@albertwenger Albert Wenger on x
For everyone who is on iOS because they deem it more secure than Android https://twitter.com/...
@bing_chris Chris Bing on x
wonder what the price of an IOS no-click zero day is nowadays https://twitter.com/...
@petejkim Pete Kim on x
⚠️ If you are using a mobile crypto wallet on an iOS device, be sure to update iOS as soon as possible! The update includes a fix for a remote arbitrary code execution vulnerability that may have been actively exploited. https://support.apple.com/...
@stshank Stephen Shankland on x
Apple released iOS 14.4, but the iPhone 12 Pro still won't remember that you switched it to use ProRaw mode. https://www.cnet.com/...
@campuscodi Catalin Cimpanu on x
NEW: Apple fixes three iOS zero-days exploited in the wild -one of the zero-days is in the iOS kernel (race condition) -two others impact WebKit (RCE) -zero-days believed to be part of an exploit chain https://www.zdnet.com/... https://twitter.com/...
@bleepincomputer @bleepincomputer on x
Apple fixed three security vulnerabilities potentially exploited in the wild, two of them affecting only iOS and iPadOS, while one also impacts tvOS and watchOS. https://support.apple.com/... https://twitter.com/...
@metamask_io MetaMask on x
🚨Attn iOS Users🚨 Take a moment to update your iOS to 14.4. Apple has released a security update that defends a malicious app vulnerability. https://support.apple.com/...
@zackwhittaker Zack Whittaker on x
New: Apple has released a software update for iPhones and iPads that fixes three security flaws, which the company says may be under active attack by hackers. https://techcrunch.com/...
@jonyiveparody @jonyiveparody on x
🚨 Update your iPhone to iOS 14.4 ASAP! #PSA #Apple https://twitter.com/...
@tomwarren Tom Warren on x
there's an iOS 14 0-day out there that may be actively exploited. Update to iOS 14.4 asap https://twitter.com/...
@chrismessina Chris Messina on x
It's always concerning when a kernel exploit is identified by Apple as having “been actively exploited”. 😟 https://support.apple.com/... #HT212146 #ios144 #ipados144 https://twitter.com/...

Chronicles