Apple Backports CoreGraphics Zero-Day Patch to Older iPhones Following Targeted Spyware Attacks

Scope: Older iPhones and iPads that did not receive last month’s CoreGraphics fix

Severity: Amber

Apple backported security patches originally released last month to older iPhones and iPads, addressing a zero-day vulnerability in the CoreGraphics component that Apple confirmed was exploited in what it described as “extremely sophisticated” targeted attacks on iOS devices, language the company typically reserves for cases involving commercial mercenary spyware rather than ordinary cybercrime. The original fix only reached newer devices when first released, leaving older iPhones and iPads that remained in active use without protection until this backport. Because this flaw was used in targeted, sophisticated attacks rather than broad opportunistic campaigns, most ordinary users face low direct risk, but anyone in a role that makes them a plausible spyware target, including government officials, journalists, and civil society figures, should treat this update as a priority rather than routine maintenance. Users running older iPhones or iPads that did not previously receive this fix must update to the latest available iOS or iPadOS version today.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.