Plan
active
Apple backports CoreGraphics zero-day fix to older iPhones/iPads
- Engineer — Plan: A patched zero-day with confirmed in-the-wild exploitation warrants action on managed iOS devices; verify your MDM policy forces the backported update on older iPhone/iPad models in your fleet before the next patch window.
- SOC/IR — Learn: The ’extremely sophisticated targeted attacks’ framing suggests nation-state or spyware-level activity rather than broad exploitation; no IOCs or TTPs are available to hunt, so file this as context for triage if an iOS-related incident surfaces.
- Leader — Plan: Sophisticated targeted exploitation of a zero-day on iOS is worth an executive-device sweep this quarter — confirm your MDM enforces the backported patch, especially for high-value targets like executives whose personal or corporate older iPhones may be unmanaged.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.