"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS," reads an Apple security bulletin released today. Apple released emergency security updates to patch two zero-day vulnerabilities that were used in an "extremely sophisticated attack" against specific targets' iPhones. With these vulnerabilities, Apple has fixed five zero-days since the start of the year, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), and the third in March (CVE-2025-24201). It is a bug in RPAC that allows attackers with read or write access to bypass Pointer Authentication (PAC), an iOS security feature that helps protect against memory vulnerabilities. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Apple has not shared further details on how the flaws were exploited in attacks. BleepingComputer contacted Apple and Google with questions about flaws but has not received a response. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies. The CVE-2025-31200 flaw in CoreAudio was discovered by Apple and the Google Threat Analysis team. Even though these zero-day flaws were exploited in highly targeted attacks, users are still strongly advised to install them as soon as possible.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 16 Apr 2025 18:10:11 +0000