Apple Issues Emergency iOS Update to Counter Zero-Click Spyware Threat
Apple has urgently rolled out security updates — iOS 26.6.1 and iOS 18.7.10 — to address a severe vulnerability that experts caution could be exploited by sophisticated zero-click spyware. This means that attackers could potentially compromise an iPhone by merely sending a malicious image, with no user interaction necessary.
The significant flaw, identified as CVE-2026-65346, is an integer-overflow vulnerability in ImageIO, Apple’s core system framework that handles the parsing and rendering of image files. As ImageIO underlies apps like Messages, Mail, and Safari, a maliciously crafted image could instigate arbitrary code execution across virtually any current or recent iPhone, iPad, or Mac — irrespective of the app used to open it.
The bug was unearthed and reported by Nik Tsytsarkin of Meta’s Red Team X. Security expert Adam Boynton, senior enterprise strategy manager at Jamf, labeled CVE-2026-65346 as the “standout fix” in the update. He pointed out that image-parsing flaws have historically been used as delivery mechanisms for zero-click spyware targeting executives and high-value individuals. The affected devices include iPhone 11 and later, supported iPad models, and macOS Tahoe systems.
While Apple asserts that it has found no evidence of active exploitation in the wild, security researchers strongly recommend all users to install the August 17–19 patches immediately. This is because cybercriminals often reverse-engineer patches to craft exploits within days of their release.
Source: The Register – Apple plugs image-processing hole ripe for spyware abuse