News

Apple has issued iOS 16.4.1, and the iPhone update comes with a warning to update now. That’s because iOS 16.4.1 fixes two security vulnerabilities—both of which are being used in real-life attacks.

Apple doesn’t offer much detail about what’s fixed in iOS 16.4.1, to give iPhone users time to update to the new software. Tracked as CVE-2023-28205, the first already-exploited flaw in WebKit, the engine that powers Apple’s Safari browser, could allow an attacker to execute code on your device, according to Apple’s support page.

Meanwhile, the second flaw fixed in iOS 16.4.1, CVE-2023-28206 is an issue in the IOSurfaceAccelerator that could enable an app to execute arbitrary code with kernel privileges.

In both cases, Apple says it “is aware of a report that this issue may have been actively exploited.”

iOS 16.4.1 fixes two security vulnerabilities—both [+][-] of which are being used in real-life attacks.Apple iPhone It goes without saying that both vulnerabilities fixed in iOS 16.4 are very serious. While it’s impossible to know the details of the attacks and who they target, Apple has issued this update on a weekend, which is very rare. The iPhone maker usually reserves important updates for Mondays or Tuesdays, so the company must have decided the iOS 16.4.1 upgrade was too important to leave. It’s also only just over week since the release of iOS 16.4.

It’s the most serious Apple update since February when the iPhone maker issued iOS 16.3.1 to fix a flaw already being used in attacks.

Why you need to update to iOS 16.4.1 now Given that iOS 16.4.1 is an emergency patch and the issue is being exploited, it’s important to update now, says indepedent security researcher Sean Wright. “I’d highly recommend that people update when they can,” he advises.

He points out that the vulnerability was identified by Amnesty International’s Security Lab: “This suggests it is being weaponised for nefarious purposes.”

The fact it’s a weekend highlights the “sheer importance” of the iOS 16.4.1 update, agrees Jake Moore, global cybersecurity advisor at ESET. “It is vital that people make sure their devices have auto-updates on and to check their settings to make sure they are the on the newest iOS,” he adds.

While automatic updates on iPhones are useful, it’s a good idea to actively install iOS 16.4.1 manually now. Because automatic updates are rolled out gradually across regions, it can sometimes take a while to reach everyone.

The iOS 16.4.1 update also fixes some bugs plaguing iPhone users, including a Siri issue. So what are you waiting for? Go to Settings > General > Software Update and upgrade to iOS 16.4.1 now to keep your iPhone safe.

Get the best of Forbes to your inbox with the latest insights from experts across the globe.Follow me on Twitter or LinkedIn. Kate O’FlahertyKate is an award winning and widely-recognized cybersecurity and privacy journalist with well over a decade’s experience covering the issues that matter to users, businesses and governments. In addition to Forbes, her work can be found in publications including Wired, The Guardian, The Observer, The Times and The Economist. 

With a focus on smartphone security including Apple iOS security and privacy, application security, cyberwarfare and data misuse by the big tech firms, Kate reports and analyzes breaking cybersecurity and privacy stories and trending topics. A co-founder of the Forbes Straight Talking Cyber video project, which has been named ‘Most Educational Content’ at the 2021 European Cybersecurity Blogger Awards, she is also a recognized industry commentator and has appeared on radio shows including the WVON Morning Show with Attorney Ernest B. Fenton, BBC Radio 5 Live and podcasts such as the Guardian’s Today in Focus. Kate can be reached at kate.oflaherty@techjournalist.co.uk.

Read MoreRead LessLoad more…Editorial Standards