#ios

2 articles

The Pegasus exploit that hit a Serbian student activist was patched eight months before the infection

2026-09-03Security

Citizen Lab and the SHARE Foundation confirmed an iMessage zero-click delivered Pegasus to a member of Serbia's student protest movement between December 2025 and January 2026. Apple fixed the flaw in iOS 18.4.1, in April 2025. The tool is identified; the operator is not.

Thirteen PHP packages ended at an iPhone kernel — and every flaw in the chain was already patched

2026-09-03Security

Socket found Composer themes on Packagist that inject JavaScript into Vietnamese streaming sites and run a WebKit-to-kernel chain on visiting iPhones, taking keychains, SMS databases and crypto wallet seeds. The campaign targets iOS 18.4 to 18.6.x. Every vulnerability it uses has a fix.