Apple releases iOS 14.8, watchOS 7.6.2, iPadOS 14.8, and macOS 11.6, which fix some CoreGraphics and WebKit flaws that defeated iOS “Blastdoor” protections
why it's critical for iPhone users Tweets: John Scott-Railton / @jsrailton : 🚨 UPDATE YOUR APPLE DEVICES NOW🚨 We caught a zero-click, zero day iMessage exploit used by NSO Group's #Pegasus spyware. Target? Saudi activist. We reported the #FORCEDENTRY exploit to @Apple, which just pushed an emergency update. THREAD 1/ https://citizenlab.ca/... https://twitter.com/... Nicole Perlroth / @nicoleperlroth : BIG NEWS: Do you own an Apple product? UPDATE IT NOW. New zero-click NSO Group #Pegasus spyware has been infecting iPhones, Macs, Watches. This is the Holy Grail of surveillance capabilities and you are vulnerable until you update. https://www.nytimes.com/... Patrick Wardle / @patrickwardle : Ah, more iOS vulnerabilities being exploited as 0days in the wild 😱😭 See iOS 14.8 security notes: https://support.apple.com/... https://twitter.com/... Mark Gurman / @markgurman : Apple says Messages exploit “not a threat to the overwhelming majority of our users” and that it is working on new protections. It also thanks Citizen Lab for obtaining a sample of the exploit and its help fixing the issue. https://twitter.com/... https://twitter.com/... Alex Russell / @slightlylate : It's absolutely medieval that Apple requires a ~300MiB download + a system reboot — ~15 minutes end-to-end — to apply a WebKit patch. https://9to5mac.com/... See also: https://infrequently.org/... https://twitter.com/... Dan Gillmor / @dangillmor : Apple could spend a rounding error of a rounding error of its cash and put the evil NSO out of business. But it just reacts. Meanwhile everyone remains at risk from these slimeballs. https://twitter.com/... Mehdi Hasan / @mehdirhasan : When will Congress hold hearings on this? How is the NSO Group allowed to get away with this stuff? A foreign (yes, Israeli) company jeopardizing the basic liberties of Americans. Aren't Republicans supposed to be obsessed with liberties or is that only for masks and vaccines?? https://twitter.com/... @fightfortheftr : Yes. Do this. But then go to https://nospyphone.com/ to tell @Apple not to install their own proprietary malware on your iPhone. #NoSpyPhone #AppleEvent https://twitter.com/... Evan Greer / @evan_greer : If you have an iPhone update it right now. And then get to one of these protests to keep Apple's own proposed proprietary spyware off your phone too! https://nospyphone.com/#map https://twitter.com/... Donie O'Sullivan / @donie : Absolutely terrifying. Complete access to your iPhone without even clicking anything. https://twitter.com/... James J. Zogby / @jjz1600 : So now they tell us! The Israeli co. #Pegasus has no-click spyware that can steal your data, turn on your camera, read encrypted messages, & make them available to countries that buy their services. It's cyber rape & a crime. Congress must investigate. https://www.nytimes.com/... Nicole Perlroth / @nicoleperlroth : Tell me one more time how zero-days aren't a big deal. https://twitter.com/... James O'Malley / @psythor : Massive news. Tim Cook must be absolutely relieved the iPhone 13 announcement on Tuesday has presumably already been prerecorded. https://twitter.com/... Judd Legum / @juddlegum : Tweeting this while updating my phone. https://twitter.com/... Wajahat Ali / @wajahatali : Researchers at Citizen Lab found that NSO Group, an Israeli spyware company, had infected Apple products without so much as a click. Nice, nice. https://www.nytimes.com/... @hrbrmstr : 🚨macOS Catalina folks: Apple dropped 11.6 that has a fixs for a _nasty_ *actively exploited* vulns in (CVE-2021-30860) PDF ops and (CVE-2021-30858) WebKit. You know the drill. https://support.apple.com/... Zack Whittaker / @zackwhittaker : Citizen Lab's findings are out. If you own an Apple device, update today. “The exploit, which we call FORCEDENTRY, targets Apple's image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.” https://citizenlab.ca/... Maddie Stone / @maddiestone : Apple patches two in-the-wild 0-days: 1 in CoreGraphics (CVE-2021-30860) for iOS and 1 in WebKit (CVE-2021-30858) https://support.apple.com/... Lukasz Olejnik / @lukolejnik : iOS 14.8 come with two inportant security fixes. “maliciously crafted PDF may lead to arbitrary code execution”, “maliciously crafted web content may lead to arbitrary code execution”. Bugs actively exploited, so: update. https://support.apple.com/...
Context & Ripple Effects
Citizen Lab’s disclosure of FORCEDENTRY follows an earlier documented case in which an activist was targeted with iPhone zero-days; the common thread is targeted surveillance exploiting Apple’s messaging and rendering surfaces. Apple’s release turns that report into patches across its phone, tablet, watch, and Mac software.
The incident also establishes a pattern visible in later coverage: Apple repeatedly issued WebKit zero-day fixes and, in 2023, patched three more actively exploited flaws across its operating systems. Blastdoor reduced exposure but did not eliminate a route through image rendering.
First-order effects
- Apple users on the affected iOS, iPadOS, watchOS, and macOS releases receive fixes for the CoreGraphics and WebKit weaknesses implicated in FORCEDENTRY.
- NSO Group loses the disclosed zero-click infection path against devices that install the updates, while Citizen Lab’s reporting becomes the immediate trigger for remediation.
Second-order effects
- Apple’s security response shifts the practical defense from Blastdoor alone to rapid software adoption across its device ecosystem, making update deployment central for targeted users.
- The later report of additional NSO zero-click hacks shows that researchers and Apple must keep finding and closing new attack paths rather than treating a single messaging hardening layer as sufficient.
Third-order effects
- The recurring sequence of targeted zero-day discovery and cross-platform emergency patches points to a durable contest between commercial spyware operators and platform security teams, with independent research disclosures shaping the defensive timetable.
- If that pattern persists, Apple’s ecosystem security posture will be judged increasingly on how quickly fixes reach every supported device class after a zero-click bypass is found.
The trend: Zero-click spyware is driving platform security toward continual mitigation, independent vulnerability discovery, and faster cross-device patch distribution.