Apple users urged to update their device software following security warnings

SINGAPORE – The Singapore Cyber Emergency Response Team (SingCert) has issued an alert urging Apple users to update the software of their iPhones and iPad to the latest iOS 26.2 after flaws in previous software versions were found to have been exploited in attacks.

SingCert, which operates under the 

Cyber Security Agency of Singapore (CSA),

said in its Dec 14 advisory: “Apple is aware that this vulnerability may have been exploited in targeted attacks.”

ST understands that CSA has not received any reports on users affected by the vulnerabilities.

Apple’s iOS 26.2, released on Dec 12, fixes over 20 flaws in the firm’s iOS software, two of which had already been used in real-life attacks.

The two flaws are in WebKit, which is Apple’s own web browser engine and the core technology behind its Safari browser on iOS, iPadOS, and macOS.

According to Apple’s support website, the two exploited vulnerabilities are CVE-2025-43529 and CVE-2025-14174. The first allows a hacker to run malicious codes remotely when a user accesses malicious web content. The second could lead to memory corruption when a user loads malicious web content.

The vulnerabilities affected the following devices and products:

Co-founder of US-headquartered cyber security firm Keeper Security Darren Guccione said that WebKit, which is a fundamental element of every iPhone browser, continues to be a prime target for attackers.

“It sits at the intersection of web content and the operating system. That makes it a valuable attack surface for adversaries seeking to compromise iOS devices,” said Mr Guccione.

Apple rolled out iOS 26.2 after sending warnings to users in some 150 countries that they were being targeted by spyware.

Other than fixing the two zero-day vulnerabilities, the new update also includes patches for over 20 security flaws.

These include vulnerabilities that allow threat actors to view photos in the hidden photos album without authentication, steal sensitive payment tokens and access password fields when remote controlling a device over Facetime.

Mr Guccione urge users to quickly update their software.

“Once Apple issues a fix, details about the vulnerabilities quickly become public, giving attackers a road map to exploit any devices that have not yet been patched. The longer users wait, the greater the risk,” he said.

“Installing iOS 26.2 is not just a matter of convenience – it’s a critical security step. Regularly updating operating systems and apps is one of the simplest yet most effective ways to protect against compromise. Every patch closes known weaknesses that sophisticated actors actively seek to exploit,” said Mr Guccione.

He added that other measures such as using strong and unique passwords for every account, enabling multi-factor authentication and learning to recognise signs of phishing are fundamentals of good cyber hygiene.