(Photo by Matt Cardy/Getty Images))
Apple has rolled out a new patch to plug a previously unknown vulnerability that hackers were abusing to target select iPhone users, after Google flagged the threat.
The fix for this "zero-day” attack rolled out yesterday with iOS 26.3 and iPadOS 26.3. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26," it says.
The flaw, dubbed CVE-2026-20700, involves a memory corruption bug in Apple's Dynamic Link Editor, which can load and link software libraries in an app. The company found that if an attacker already has the ability to write memory to an iPhone, they can abuse the flaw to execute rogue computer code, giving them a way to tamper with the software.
The vulnerability alone can’t hack an iPhone. However, Apple’s report suggests the flaw was part of a chain of software exploits used to remotely hack certain iPhones. The company noted the threat is related to two other previously unknown vulnerabilities, CVE-2025-14174 and CVE-2025-43529, that Apple patched in December. The earlier flaws involved “processing maliciously crafted web content,” suggesting the threat came from phishing websites or messages.
We wouldn’t be surprised if the vulnerabilities were used to deploy spyware. Apple learned of the threat from Google’s Threat Analysis Group (TAG), which focuses on countering government-sponsored cyberattacks. Typically, state-sponsored hackers or even government authorities deploy spyware to small groups of high-value targets, such as politicians, human rights activists, and journalists, to prevent the device maker and security researchers from detecting the attack.
In this case, the hackers may have been exploiting the vulnerability for some time, since they targeted users running older versions of Apple's mobile OS; iOS 26 launched in September.
Apple didn't say how many users were affected. But it also released a CVE-2026-20700 patch for macOS, visionOS, tvOS, and watchOS. To prevent the most sophisticated hacking threats, Apple offers a Lockdown Mode for its devices, which has been shown to defeat spyware.
Apple iPhone owners can update their devices by going to Settings > General > Software Update. The phone can also patch itself automatically if you’ve toggled on automatic updates.