Federal Agency Advises Americans to Update Their IPhones, MacBooks After Security Update

A woman uses her iPhone, in a file photo. Jack Guez/AFP via Getty Images

Apple pushed out multiple security updates this week for iPhones, MacBooks, and other devices that use either iOS or MacOS, leading a federal agency to advise people to apply them.

In its iOS 18.2 update, Apple said it fixed about 20 different security flaws, including one that could allow apps “to access sensitive user data” and another that could allow an app that could “cause unexpected system termination or corrupt kernel memory.”

Another more serious issue that was filed in the update had allowed a “remote attacker” to cause an “unexpected app termination or arbitrary code execution,” according to Apple.

Apple also sent out security patches for several bugs to its kernel that may allow attackers to use memory mappings to leak sensitive kernel state information, it said.

At the same time, Apple released an update for MacOS 15.2 that fixed a range of security issues as well as updates for Safari 18.2, iPadOS 17.7.3, MacOS Sonoma 14.7.2, MacOS Ventura 13.7.2, WatchOS 11.2, VisionOS 2.2, and tvOS 18.2.

For the MacOS updates, Apple also released security fixes for the IOMobileFrameBuffer that can allow arbitrary code execution, according to its release notes.

Apple has long said that it will not release details of the security fixes and again reiterated its stance this week.

“For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available,” it said. “Recent releases are listed on the Apple security releases page.”

It’s not clear whether any of the security flaws were being actively exploited.

The latest series of Apple updates prompted the U.S. Cybersecurity and Infrastructure Agency (CISA) to advise users and administrators on Dec. 12 to review Apple’s “advisories and apply necessary updates.”

“Apple released security updates to address vulnerabilities in multiple Apple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system,” CISA said in its statement.

In November, the California-based tech giant released security updates for its iOS 18.1 addressing vulnerabilities in iPhones, iPads, and Mac products.

“Apple is aware of a report that this issue may have been actively exploited on Intel-based Macs,” the company wrote at the time.

This month, officials with CISA advised Americans to use encrypted messaging platforms in the midst of a sprawling hacking campaign that originated in China in recent days. Messaging apps with end-to-end encryption include Signal, WhatsApp, and others.

“Our suggestion, what we have told folks internally, is not new here: Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication. Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible,” a top CISA official, Jeff Greene, said in a call with reporters in December.

How to Update

For iPhone or iPad users who do not have their devices set to automatically update, tap the “Settings” app, select “General Software Update” if the update is available, and tap “Download and Install.” For those who want the update to occur overnight, tap “Update Tonight” and follow any additional prompts.

For MacOS users, open the “Apple” menu, select “System Settings,” click “General” on the sidebar, and click “Software Update” on the right of the screen if an update is available.

Reuters contributed to this report.