> ## Content Index
> Fetch the complete content index at: https://www.theamericanquorum.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Apple Patches Two Actively Exploited Zero-Days Across iPhones, iPads and Macs
- URL: https://www.theamericanquorum.com/taq-historical-2022-08-20-tech/
- Published: 2022-08-21T03:59:00.000Z
- Updated: 2022-08-21T03:59:00.000Z
- Description: Apple issued emergency updates for two vulnerabilities it says may be under active exploitation, affecting WebKit and operating-system kernels across major devices.
- Author: Kenneth R. Deans Jr.
- Tags: Tech, #Import 2026-08-31 15:55

Apple has released urgent security updates for iPhones, iPads and Macs after disclosing two vulnerabilities that the company says may already have been exploited in active attacks. The flaws reach two unusually sensitive parts of the software stack: WebKit, the browser engine used by Safari, and the operating-system kernel, which controls core device privileges.

The mobile fixes arrived in [iOS 15.6.1 and iPadOS 15.6.1](https://support.apple.com/en-us/103005?ref=theamericanquorum.com) on August 17\. Apple said CVE-2022-32893 could allow maliciously crafted web content to execute arbitrary code, while CVE-2022-32894 could allow an application to execute code with kernel privileges. For both vulnerabilities, Apple said it was aware of a report that the issue “may have been actively exploited.”

## Two flaws expose different layers of the device

The first vulnerability sits in WebKit, the engine that renders web content across Apple platforms. Apple describes CVE-2022-32893 as an out-of-bounds write that was addressed through improved bounds checking. In practical terms, a flaw in the way software handles memory boundaries can allow specially crafted content to write data where it should not, potentially opening a path to arbitrary code execution.

The second flaw, CVE-2022-32894, affects the kernel. Apple’s [macOS Monterey 12.5.1 advisory](https://support.apple.com/en-us/103006?ref=theamericanquorum.com) says an application may be able to execute arbitrary code with kernel privileges and again notes a report of possible active exploitation. Kernel-level execution is particularly serious because the kernel sits beneath ordinary applications and enforces some of the operating system’s most important security boundaries.

Apple also released [Safari 15.6.1](https://support.apple.com/en-us/103007?ref=theamericanquorum.com) for macOS Big Sur and macOS Catalina on August 18 to address the WebKit vulnerability. That separate Safari release broadens the scope beyond machines running Monterey and reflects the fact that the browser-engine flaw is relevant across multiple supported operating-system versions.

## Government defenders move quickly

The Cybersecurity and Infrastructure Security Agency added both vulnerabilities to its [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field%5Fcve=CVE-2022-32893&ref=theamericanquorum.com) on August 18, with a September 8 remediation deadline for covered federal civilian agencies. CISA’s catalog is reserved for vulnerabilities for which there is evidence of exploitation and directs agencies to apply vendor-provided fixes.

New York State’s Office of Information Technology Services issued its own [August 18 advisory](https://its.ny.gov/2022-105-updated?ref=theamericanquorum.com), warning that successful exploitation of the most severe Apple vulnerabilities could permit arbitrary code execution and, depending on the privileges of the affected user, allow an attacker to install programs, view or alter data or create new accounts. The state advisory was updated August 19 as additional Apple products and fixes were incorporated.

The rapid public-sector response reflects a shift in vulnerability management toward prioritizing flaws known or strongly suspected to be exploited rather than treating every software defect equally. For organizations managing large fleets of iPhones, iPads and Macs, the presence of a vulnerability in a known-exploited catalog changes patching from routine maintenance into an immediate incident-prevention task.

## Apple provides little detail about the attackers

Apple has not said who discovered the two flaws, identifying the researcher only as anonymous, and it has not described who is exploiting them, how many devices may have been targeted or whether the two vulnerabilities have been used together. The company’s disclosures are therefore significant for what they establish — active exploitation may be occurring — but limited in what they reveal about the campaign behind it.

That ambiguity is common with high-value mobile vulnerabilities. A WebKit flaw can provide an initial route into a device through malicious web content, while a separate kernel vulnerability can potentially help an attacker move from the restrictions of an application or browser process into a more privileged position. Apple has not said publicly that these two bugs form a single exploit chain, and users should not assume that they do. Their simultaneous disclosure, however, means both layers require remediation.

Contemporary security reporting has emphasized the seriousness of the combination. The [Guardian reported August 18](https://www.theguardian.com/technology/2022/aug/18/apple-security-flaw-hack-iphone-ipad-macs?ref=theamericanquorum.com) that security specialists were urging rapid updates, particularly for people who may be targets of sophisticated surveillance, including journalists and activists. The report also noted that Apple’s short advisories did not provide technical details about the attacks themselves.

## The affected population is broad

Apple says the iOS and iPadOS fixes apply to iPhone 6s and later, all iPad Pro models, iPad Air 2 and later, fifth-generation iPad and later, iPad mini 4 and later, and the seventh-generation iPod touch. macOS Monterey users receive both fixes in version 12.5.1, while Safari 15.6.1 provides the WebKit repair for Big Sur and Catalina.

The breadth matters because Apple devices are common both in consumer use and in enterprises that rely on mobile-device-management systems. Organizations may be able to push or require updates centrally, but individually managed devices depend on users installing them. A security update can be available globally and still leave a long tail of vulnerable systems if users defer installation.

The U.S. government’s [separate catalog entry for CVE-2022-32894](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field%5Fcve=CVE-2022-32894&ref=theamericanquorum.com) reinforces that both bugs require attention. CISA lists the kernel issue as an Apple iOS and macOS out-of-bounds write vulnerability added August 18 and instructs agencies to apply vendor updates.

## Updating is the decisive mitigation

There is no public indication that ordinary users can reliably detect whether either flaw has been used against their devices. That makes prevention more important than self-diagnosis. Apple’s remediation is straightforward: install the newly released operating-system and Safari updates on supported devices.

The episode also arrives as Apple is preparing additional security features for its next generation of operating systems, including a highly restrictive Lockdown Mode for users who face exceptional targeted threats. But future protections do not resolve present vulnerabilities. For CVE-2022-32893 and CVE-2022-32894, the relevant defense this week is the software Apple has already shipped.

For enterprises, government agencies and individuals, the risk calculation is unusually clear. Apple has acknowledged possible active exploitation; the flaws can enable arbitrary code execution; and fixes are available across the principal affected platforms. The remaining variable is how quickly those fixes reach the devices that need them.