Apple Patches Two Zero-Days Used in ‘Extremely Sophisticated’ Attacks
Image: ink drop/Adobe Stock Apple has rolled out emergency updates to patch two serious security flaws that were actively being exploited in highly targeted attacks on iPhones and other Apple devices. The fixes, released on April 16 as part of iOS 18.4.1 and macOS Sequoia 15.4.1, address zero-day vulnerabilities. Apple said these bugs were used in an “extremely sophisticated attack against specific targeted individuals on iOS.” Inside the iOS and macOS vulnerabilities The two bugs, tracked as CVE-2025-31200 and CVE-2025-31201, affect Apple’s software’s CoreAudio and RPAC components. CVE-2025-31200 (CoreAudio): This bug allows hackers to take control of a device simply by tricking it into processing a malicious media file. Apple credited the discovery to its internal team and researchers from Google’s Threat Analysis Group — a unit known for tracking advanced cyberattacks, often linked to government actors. CVE-2025-31201 (RPAC): This flaw affects a security mechanism called Pointer Authentication, designed to prevent memory attacks. Hackers who have read and write access to a device could bypass this protection and hijack the system. Apple found and fixed …



