- Embarrassing bug comes four days before the announcement of a new iPhone
- Apple has had to roll out a last minute software update – here’s how to get it
Just six weeks since it released its last software update, Apple has had to issue an urgent follow up.
iOS 16.6.1, released globally on Thursday, fixes a security bug that leaves iPhones vulnerable to ‘spyware’ – software that steals information from a device.
Apple was alerted to the bug by the University of Toronto’s Citizen Lab, which said it is ‘capable of compromising iPhones without any interaction from the victim’.
In a web post about iOS 16.6.1, Apple confirmed the new update ‘provides important security fixes’ without giving any additional details, although it did acknowledge Citizen Lab experts ‘for their assistance’.
Apple is due to announce a brand new mobile operating system, called iOS 17, along with the new iPhone 15 next week.
Apple confirmed the update ‘provides important security fixes’ but it wouldn’t confirm any further details
Unfortunately, the bug is too dangerous to wait for the release of iOS 17 (expected later this month) so Apple has had to quickly roll out this latest version of 16.6.
To install the urgent update, users just need to head to their iPhone Settings and select ‘General’ followed by ‘Software Update’.
A fact box about iOS 16.6.1 should appear with the message: ‘This update provides important security fixes and is recommended for all users.’
Tapping ‘Download and Install’ should start the update, which could take a few minutes to complete.
Apple said the update is also available for iPadOS, the operating system running on its iPads.
The tech giant said: ‘For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available.’
Apple is already expected to announce a brand new mobile operating system, called iOS 17, along with the new iPhone 15 next week . But it’s had to quickly roll out this latest update to its current system iOS 16 due to the potential dangers of the bug
However, Citizen Lab provides plenty more details about the vulnerability, which is being used by cybercriminals to deliver the notorious ‘Pegasus’ spyware, created by Israeli firm NSO Group.
In a blog post, Citizen Lab said it uses an ‘exploit chain’ method – one involving multiple vulnerabilities to compromise the victim step-by-step – but without any interaction from the victim (‘zero click’).
‘Citizen Lab immediately disclosed our findings to Apple and assisted in their investigation,’ the research group said.
‘We expect to publish a more detailed discussion of the exploit chain in the future.
‘We urge everyone to immediately update their devices.
‘This latest find shows once again that civil society is targeted by highly sophisticated exploits and mercenary spyware.’
Citizen Lab also advised any unnamed iPhone user ‘who may face increased risk because of who they are or what they do’ to enable Lockdown Mode, Apple’s security feature first released last year.
Citizen Lab provides plenty more details about the vulnerability, which is being used by cybercriminals to deliver the notorious ‘Pegasus’ spyware, created by Israeli firm NSO Group (file photo)
Citizen Lab also advised any iPhone user ‘who may face increased risk because of who they are or what they do’ to enable Lockdown Mode, Apple’s security feature first released last year
When a device is in Lockdown Mode, apps, websites and features are restricted for security reasons, and others are completely disabled.
For example, most message attachment types in the Messages app other than images are blocked and other features, like link previews, are disabled.
Lockdown Mode is an optional protection for users who face ‘grave, targeted threats to their digital security’, like journalists and activists, Apple said.
