The software releases came the day before a highly anticipated Apple product launch event on Tuesday. “Narrowing the attack surface from chat apps will go a long way toward making all of our devices more secure.”Īpple is patching the bug on the iPhone, iPad, Mac and Apple Watch via iOS 14.8, iPadOS 14.8, macOS 11.6 and watchOS 7.6.2 software updates. “They need to be a major priority for security,” he added. “They are ubiquitous, which makes them really attractive, so they are an increasingly common target for attackers. “What this highlights is that chat apps are the soft underbelly of device security,” John Scott-Railton, senior researcher at Citizen Lab, said in a text message. Victims didn’t have to click on the malicious file for it to infect their devices, something known as a “zero-click” exploit, according to a report released by Citizen Lab, a cyber-research unit of the University of Toronto. The flaw was a “zero-day” vulnerability, a term that refers to recently discovered bugs that hackers can exploit and haven’t yet been patched. Apple said the flaw could be exploited if a user on a vulnerable device received a “maliciously crafted” PDF file. The flaw, disclosed Monday by Citizen Lab, allowed a hacker using NSO’s Pegasus malware to gain access to a device owned by an unnamed Saudi activist, according to security researchers. said it patched a security flaw in its Messages app after security researchers determined that Israel-based NSO Group used it to “exploit and infect” the latest devices with spyware.

Pegasus ios