Apple releases iOS 15.3.1, iPadOS 15.3.1, and macOS Monterey 12.2.1 to fix a WebKit flaw that may have been actively exploited, its third zero-day patch in 2022
Friday, February 11, 2022 // (IG): BB //Weekly Sponsor: BLKTRIANGLE Pieter Arntz / Malwarebytes Labs : Update now! Apple fixes actively exploited zero-day Ravie Lakshmanan / The Hacker News : Apple Releases iOS, iPadOS, macOS Updates to Patch Actively Exploited Zero-Day Flaw David Lumb / CNET : Another small iPhone update is rushed out to fix a security flaw Hoakley / The Eclectic Light Company : What has changed in macOS Monterey 12.2.1? Jason Cross / Macworld : iOS 15.3.1 released to patch critical zero-day WebKit vulnerability Imran Hussain / iThinkDifferent : iOS 15.3.1 and iPadOS 15.3.1 released with bug fixes and security patches Tweets: Zuk / @ihackbanme : Surprise surprise! Another day another 0day exploited in the wild https://www.bleepingcomputer.com/ ... Incremental patches/mitigations will never work against determined individuals. The only thing that will help to reduce mass surveillance on mobile phones is more eyes. #FreeTheSandbox 👊 Aaron Schaffer / @aaronjschaffer : Apple just released updates to iOS, MacOS, and iPadOS. All fix a vulnerability (CVE-2022-22620) that “may have been actively exploited” #itw0days https://support.apple.com/... https://support.apple.com/... Yan / @bcrypt : Apple: free as in use-after https://twitter.com/... DeWitt Clinton / @dewitt : IMO, if Apple intends to keep having zero-days every few weeks, then iOS/iPadOS releases are going to have to get a heck of a lot lighter and quicker to apply. Updating multiple iPads and an iPhone and a Watch by hand each time is getting to be a drag. https://www.bleepingcomputer.com/ ... Kosta Eleftheriou / @keleftheriou : “Apple is aware of a report that this issue may have been actively exploited,” the company said about a WebKit issue that could lead to [...] code execution on compromised devices. Perhaps a WebKit monoculture isn't such a great idea after all? https://twitter.com/... Tom Warren / @tomwarren : iOS 15.3.1 is out. It patches a 0-day security vulnerability https://www.theverge.com/... https://twitter.com/... Zack Whittaker / @zackwhittaker : Apple just rolled out iOS and iPadOS 15.3.1, and macOS Monterey 12.2.1, to patch a zero-day vulnerability in WebKit that “may have been actively exploited.” Update ASAP. Maddie Stone / @maddiestone : WebKit in-the-wild patched today ⬇️ https://twitter.com/...
Context & Ripple Effects
Apple had already addressed WebKit and CoreGraphics flaws that bypassed Blastdoor protections across its operating systems in 2021. This release extends that cross-platform security-response pattern to a WebKit issue reported as potentially exploited.
The pattern intensified later in 2022, when Apple issued another cross-platform update for two potentially exploited zero-days, placing this patch in a sequence of rapid fixes rather than an isolated maintenance release.
First-order effects
- iPhone, iPad, and Mac users receive fixes for CVE-2022-22620, reducing exposure on devices that install the new OS versions.
- Apple must distribute and support coordinated updates across iOS, iPadOS, and macOS because the affected component spans its device ecosystem.
Second-order effects
- Organizations managing Apple fleets face a quicker validation-and-deployment cycle when browser-engine flaws may be under active attack.
- The shared WebKit exposure makes update adoption across Apple device categories more consequential than a patch limited to one operating system.
Third-order effects
- Repeated emergency fixes make sustained patch deployment a core part of Apple ecosystem security, with protection depending on how quickly users and managed fleets install updates.
- If the cadence persists, shared browser-engine components will remain a recurring source of cross-platform security risk and coordinated remediation for Apple.
The trend: Apple’s security response is increasingly organized around rapid, ecosystem-wide patches for potentially exploited flaws in shared platform components.