Apple Quietly Fixed Zero-Day Exploit Used in Paragon Spyware Attack - MacRumorsOpen MenuShow RoundupsShow Forums menuVisit ForumsOpen Sidebar
Skip to Content

Apple Quietly Fixed Zero-Day Exploit Used in Paragon Spyware Attack

by

Apple today quietly updated the list of security fixes that were introduced in iOS 18.3.1, noting a previously undisclosed fix for a zero-day vulnerability affecting the Messages app.

bug security vulnerability issue fix larry
Apple acknowledged the fix after security researchers from The Citizen Lab shared details on the flaw, which had been used to target two European journalists. The Messages vulnerability was exploited with the "Graphite" mercenary spyware created by Paragon. Paragon's spyware has been used in targeted attacks against journalists and human rights activists across multiple platforms.

According to Apple, a maliciously crafted photo or video shared through an iCloud link led to a logic issue that allowed for the infiltration of targeted devices. Apple's release notes say that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals."

Apple confirmed to The Citizen Lab that it fixed the vulnerability back when iOS 18.3.1 was released in February, but it is not clear why Apple did not disclose it before today.

Note: Due to the political or social nature of the discussion regarding this topic, the discussion thread is located in our Political News forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Tag: Vulnerabiltiies

Popular Stories

iOS 27 Next to iPhone

Here's When iOS 27 Rolls Out Today in Every Time Zone [Update: It's Out]

Sunday September 13, 2026 3:00 am PDT by
Update 10:04 a.m.: iOS 27 is rolling out now, though it may take a bit for all users to see it, so keep checking! Apple is about to release iOS 27, which will finally deliver more advanced Siri AI capabilities as well as a variety of other refinements, improvements, and new features to iPhones. It's Apple's biggest software update of the year, and Apple announced at Wednesday's iPhone event...
Read Full Article • 151 comments
iOS 27 Icon iPhone

iOS 27 Available Now With These 8 New Features

Monday September 14, 2026 9:00 am PDT by
Update — 10 a.m. Pacific Time: Apple has released iOS 27. During its iPhone 18 Pro and iPhone Duo event last week, Apple announced that iOS 27 will be released widely on Monday, September 14. iOS 27 should be available around 10 a.m. Pacific Time / 1 p.m. Eastern Time today via the Settings app, under General → Software Update. Below, we have highlighted eight new features and...
Read Full Article • 111 comments
Apple iCloud Plus expansion hero

iCloud+ Now Includes Apple TV, Apple Arcade, and Curated Apple Music Stations in Over 100 Countries

Tuesday September 15, 2026 1:43 am PDT by
Apple today announced a new subscription initiative that turns paid iCloud+ subscriptions into a broader services bundle in more than 100 countries. In select countries, Apple says every paid iCloud+ plan, including the cheapest 50GB tier, now includes Apple TV and Apple Arcade "at no additional cost," while family sharing extends the storage, TV and Arcade access to up to five people....
Read Full Article • 106 comments

Top Rated Comments

russell_314 Avatar
russell_314
17 months ago

Great to see a US-backed company working on surveilling journalists and activists.

Can't wait to see the feds using this on us
Nothing new. The US government has been using private companies and NGO’s for years or likely decades to do their dirty work. The US government might not be allowed to censor or spy on citizens, but they can have a private organization do it for them.
Score: 6 Votes (Like | Disagree)
A
aloysiusfreeman
17 months ago
Great to see a US-backed company working on surveilling journalists and activists.

Can't wait to see the feds using this on us
Score: 6 Votes (Like | Disagree)
Plutonius Avatar
Plutonius
17 months ago
It's good to see that Apple addressed this exploit. Unfortunately, the next exploit will probably hit soon if it already hasn't :(.
Score: 5 Votes (Like | Disagree)
Mousse Avatar
Mousse
17 months ago

Much of the above seems like a gross generalization. Who determines a fair and equitable salary for employees? Certainly not MR posters.
Not who, but what. Productivity determines what is fair and equitable.
MacRumors content image
MacRumors content image
As you can see, compensation hasn't matched productivity since the 70's.
Score: 3 Votes (Like | Disagree)
Mousse Avatar
Mousse
17 months ago

Paragon is just making big money by turning a blind eye who it sells its software to, just like it always has.

<snip>

But it should really trigger your ethics, when you see your software used this way. Again and again.
98th Rule of Acquisition: Every man has his price.

In the Twilight Zone episode, Button, Button, a man delivered a box with a button on it to a couple. He told them if they push the button, they will receive $200,000. In exchange, someone they don't know will die.

Morals and ethics means little to most corporate executives. If ethics mattered to them, their employees would be compensated fairly. If they don't care about their employees, do you think some random journalist they might never heard of matters to them?
Score: 3 Votes (Like | Disagree)
russell_314 Avatar
russell_314
17 months ago

More likely trying to not create a new news cycle about the original exploit. They fixed the issue but left it out of the release notes initially, because of course people are going to be looking at those release notes when an update is brand new. Then once most people have the update and interest has died down, update them so it's on record in case anyone says "there was this exploit and Apple never patched it".
Every time I’ve seen Apple release updates for security patches they never describe the actual security flaw. So I guess Apple always “quietly” updates their security vulnerabilities 😂




Just like Apple. I am sure Snowden didn’t make everything up. I also believe the Bloomberg report about China installing chips on Apple’s servers was probably legitimate; why would Apple admit to it?
You’re absolutely right it would not benefit Apple to admit they had a security breach, but if they know customer data has been breached they have to tell people. This is written into law from my understanding.



Their whole business model is made in China with slave labor. Funny thing is people believe the marketing hype about Apple caring about our privacy - AAPL cares about the illusion of our privacy.
You just described every product you buy in 2025. At least products sold in the USA. Everything you’re wearing was probably made the way you describe. Most of your gadgets in your home were made that way. Likely just about everything you own was made that way. Unfortunately that’s a terrible fact of how things are going now, but it’s not exclusive to Apple. It’s either made in China or a similar country with similar working conditions. In some cases products are made outside of China because China is too strict about working conditions compared to those countries.
Score: 3 Votes (Like | Disagree)
Read All Comments