Apple has rolled out emergency updates to fix two dangerous flaws in iOS, iPadOS, and macOS. These zero-day vulnerabilities were already used in live attacks.
The company confirmed that attackers had targeted a small number of iPhone users with advanced techniques. Security researchers called the operation highly sophisticated.
One of the flaws, identified as CVE-2025-31200, was found in the CoreAudio component. Apple explained that playing a malicious audio file could let hackers run harmful code on a device. To stop this, Apple added stronger checks to its memory handling. Google’s Threat Analysis Group (TAG) discovered the issue.
The second vulnerability, CVE-2025-31201, affected RPAC. Attackers could use it to bypass Pointer Authentication—a critical security feature in ARM-based Apple chips. This protection helps ensure that memory pointers haven’t been tampered with. Apple removed the vulnerable code entirely to fix the issue.
Although these bugs also affected macOS Sequoia, the known attacks only targeted iPhones. Apple has not said who the attackers were, but the level of complexity suggests a nation-state or spyware operation.
The company stressed that these flaws were exploited in very targeted campaigns. That means most users were not affected, but anyone using an Apple device should update it immediately.
Security experts echoed this advice. Even if you don’t see signs of a breach, it’s best to install the fix as soon as possible. Zero-day attacks are often silent and hard to detect.
This incident highlights the growing risk of zero-day vulnerabilities—even in devices known for strong security. Apple’s quick response shows the need for constant vigilance as attackers become more creative and aggressive.
