Consumer Technology

Apple has warned that two critical WebKit flaws used in "extremely sophisticated" attacks could let malicious websites run arbitrary code on iPhones and iPads, enabling device takeover, password theft and access to payment data simply by visiting the wrong page. The company says the bugs affect iPhone 11 and later models plus recent iPad Pro, iPad Air, iPad and iPad mini generations, and that the only effective fix is upgrading to iOS 26.2 or iPadOS 26.2 because it is no longer offering a security‑only update for users who want to stay on iOS 18. Usage data cited in the piece suggest a large patch gap: roughly half of eligible users, and possibly as many as 80% worldwide, have yet to update, leaving an estimated hundreds of millions of devices exposed, including a huge share of U.S. phones. Security experts quoted say there is no user‑behavior workaround, since the vulnerability resides deep in Safari’s browser engine and in every browser that runs on iOS, and that risk rises once technical details are public because attackers can reliably weaponize them. The article walks users through how to check and update their software via Settings > General > Software Update, underscoring that timely patching is now the only real protection against this active exploit.