Apple patches decade-old iOS zero-day exploited in the wild

"An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26."

"Think of dyld as the doorman for your phone. Every single app that wants to run must first pass through this doorman to be assembled and given permission to start. Usually, the doorman checks credentials and places apps in a high-security 'sandbox' where they can't touch your private data. This vulnerability allows an attacker to trick the doorman into handing over a master key before security checks even begin."

"attackers have created a 'zero-click' or 'one-click' path to total control. They use a fake ID to bypass the front gate - your browser - and then exploit the doorman's flaw to take over the entire building,"

A zero-day vulnerability (CVE-2026-20700) in dyld, Apple's dynamic linker, affects every iOS version since 1.0 and allows attackers with memory write capability to execute arbitrary code. Google Threat Analysis Group discovered the flaw and Apple confirmed in-the-wild exploitation possibly used in a targeted, extremely sophisticated attack against individuals on iOS versions before iOS 26. Google also referenced two high-severity December Chrome vulnerabilities: CVE-2025-14174 (an ANGLE out-of-bounds memory access on Mac) and CVE-2025-43529 (a use-after-free leading to code execution). Security analysts warn that chaining dyld with WebKit flaws can produce zero-click or one-click full device takeover paths resembling commercial surveillance exploits.

Read at Theregister