Apple released emergency updates to backport security patches out fridayfixing two actively exploited zero-day flaws also affecting older iPhones, iPads and Macs.

“Apple is aware of a report that this issue may have been actively exploited,” the company said in security notice published Monday.

The first (tracked as CVE-2023-28206) is an out-of-bounds write weakness in IOSurfaceAccelerator that allows attackers to execute arbitrary code with kernel privileges on targeted devices through maliciously crafted applications. .

The second zero-day (CVE-2023-28205) is a post-release use of WebKit that can allow hackers to execute malicious code on compromised iPhones, Macs, or iPads after tricking their targets into loading malicious web pages .

Today, Apple looked at zero-days by iOS 15.7.5 and iPadOS 15.7.5, macOS Monterey 12.6.5And macOS Big Sur 11.7.6 improving input validation and memory management.

The company says the bugs are now also fixed on the following list of devices:

• iPhone 6s (all models),
• iPhone 7 (all models),
• iPhone SE (1st generation),
• iPad Air 2,
• iPad mini (4th generation),
• iPod touch (7th generation),
• and Macs running macOS Monterey and Big Sur.

The flaws were reported by security researchers from Google’s Threat Analysis Group and Amnesty International’s Security Lab, which discovered that they are exploited in attacks as part of an exploit chain.

Both organizations often report government-backed threat actors using similar tactics and vulnerabilities to install spyware on the devices of high-risk individuals around the world, such as journalists, politicians, and dissidents.

For example, they recently shared campaign details abuse two chains of exploitation targeting Android, iOS and Chrome bugs to install commercial surveillance malware.

CISA too federal agencies ordered to patch their devices against these two security vulnerabilities, known to be actively exploited in the wild to hack iPhones, Macs and iPads.

In mid-February, Apple patched another zero-day WebKit (CVE-2023-23529) which was in attacks to trigger crashes and achieve code execution on vulnerable iOS, iPadOS and macOS devices.