Two Apple Zero-Days Under Active iOS Attack

Apple has released iOS 18.4.1 and iPadOS 18.4.1 to fix two zero-day vulnerabilities that were actively exploited in highly targeted and sophisticated attacks.

Vulnerabilities Explained

The issues were found in two key components:

CoreAudio (CVE-2025-31200): A memory corruption flaw that could be triggered by a malicious media file, allowing attackers to execute harmful code.
RPAC (CVE-2025-31201): A security bypass that could let attackers disable Pointer Authentication, a critical defense mechanism in iOS.

These vulnerabilities weren’t just theoretical—they were actively used in real-world attacks targeting specific iPhone and iPad users. Apple and Google’s Threat Analysis Group confirmed that the flaws were part of a highly advanced campaign. With iOS 18.4.1 and iPadOS 18.4.1, Apple has patched the memory issue in CoreAudio and removed the vulnerable code in RPAC, effectively closing both security gaps. Updating your device is strongly recommended to stay protected.

Devices Affected

Apple’s latest security update—iOS 18.4.1 and iPadOS 18.4.1—applies to a wide range of devices, including:

iPhone XS and later
iPad mini (5th generation and later)
iPad (7th generation and later)
iPad Air (3rd generation and later)
iPad Pro 11-inch (1st generation and later)
iPad Pro 13-inch and 13.9-inch (3rd generation and later)

The update fixes two major security issues. One was a bug in CoreAudio, which Apple patched with improved checks. The other was in RPAC, which Apple resolved by removing the vulnerable code.

Although Apple hasn’t shared details about who was targeted or responsible, the complexity of the attacks points to highly advanced threat actors—possibly even nation-state groups. These zero-day flaws are rare and often used in espionage or against high-profile individuals.

Cybersecurity experts stress the urgency of this update. One analyst noted, “These exploits are a stark reminder of how critical timely updates are. Users must act quickly to secure their devices.”

As usual, Apple kept details under wraps until the fixes were ready, following its standard approach to user safety. The security notes, released on April 16, 2025, list all affected devices and vulnerabilities. More information can be found on the Apple Product Security page.

To update, go to Settings > General > Software Update and install iOS/iPadOS 18.4.1. Apple strongly recommends updating right away to stay protected.