Google and Apple roll out emergency security updates after zero-day attacks | TechCrunch

"On Wednesday, Google released patches for a handful of security bugs in its Chrome browser, noting that one of the bugs was being actively exploited by hackers before the company had time to patch it. Unusually for Google, the company provided no further details at the time. But on Friday, Google updated the page to say that the bug was discovered by Apple's security engineering team and Google's Threat Analysis Group, whose security researchers primarily track government hackers and mercenary spyware makers, indicating that the hacking campaign may have been orchestrated by government-backed hackers."

"According to the security advisory for iPhones and iPads, Apple patched two bugs that the company said it was aware "that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals" running devices prior to iOS 26. That language is Apple's typical way of saying that it knows some of its customers and users were targeted by hackers exploiting zero-days, meaning flaws that at the time of exploitation are unknown to the software makers."

Apple and Google released software updates to protect users from a hacking campaign affecting an unknown number of devices. Google patched multiple Chrome vulnerabilities, including one that was being actively exploited before a fix, and later attributed discovery to Apple's security engineering team and Google's Threat Analysis Group, suggesting potential government-backed actors. Apple issued updates across iPhones, iPads, Macs, Vision Pro, Apple TV, Apple Watches, and Safari, and patched two iOS bugs that may have been exploited in an extremely sophisticated attack against specific targeted individuals prior to iOS 26. Zero-day exploits and mercenary spyware are often used to target journalists, dissidents, and activists.

Read at TechCrunch