Details of the Security Advisory

The Indian government has alerted users of Apple devices regarding significant security vulnerabilities, urging them to update their software to mitigate risks of cyberattacks. This advisory was released by the Indian Computer Emergency Response Team (CERT-In) on October 28, 2023, and is classified as high severity. The advisory, identified as CIAD-2026-0056, highlights various vulnerabilities that could potentially allow attackers to execute malicious code, gain unauthorised access to devices, steal sensitive data, or circumvent security measures.

According to CERT-In, the flaws could be exploited through specially crafted web content, files, images, audio, or video, as well as via other vulnerable applications and system components. The warning is directed at both individuals and organisations using the affected Apple products, which include iPhones, iPads, Macs, Apple Watches, and Apple TVs.

The advisory underscores the importance of immediate action, as the vulnerabilities could lead to significant security breaches, including making devices or systems unavailable. Users are advised to take the necessary steps to ensure their software is up to date to prevent exploitation.

Affected Apple Devices and Software Versions

The CERT-In advisory specifically identifies older versions of several Apple operating systems and the Safari browser as being at risk. Apple had released updates for these platforms on October 26, 2023, just two days prior to the advisory’s issuance. The affected software versions include iOS versions earlier than 18.7.11, 26.7.2, or 27.2 for iPhones. This includes models such as the iPhone XS, XS Max, XR, and iPhone 11 and newer devices operating on the aforementioned branches.

iPads running iPadOS versions earlier than 18.7.11, 26.7.2, or 27.2 are also at risk, which includes the iPad 7th generation and newer models. For Mac computers, those running macOS Sequoia versions earlier than 15.8.2, macOS Tahoe versions earlier than 26.7.2, or macOS Golden Gate versions earlier than 27.2 are included in the advisory. Additionally, Apple Watches operating on watchOS versions prior to 27.2 and Apple TVs running tvOS versions earlier than 27.2 are also affected.

Furthermore, the Apple Vision Pro headsets running visionOS versions earlier than 27.2 and the Safari browser on compatible Macs using macOS Sequoia and Tahoe are included in the list of vulnerable devices. Users are encouraged to verify the specific software version installed on their devices, as compatibility may vary by model.

Recommended Actions for Users

In light of the vulnerabilities identified, CERT-In recommends that Apple users take immediate action to secure their devices. The advisory specifically mentions issues such as memory corruption, buffer overflows, out-of-bounds read/write problems, and race conditions that could be exploited by attackers. These vulnerabilities can lead to compromised device integrity or system crashes if successfully exploited.

To check for available updates, Apple users can navigate to their device settings. For iPhones and iPads, the path is Settings > General > Software Update. Mac users should go to System Settings > General > Software Update. Those using Apple Watch, Apple TV, or Vision Pro can find update options in their respective settings menus.

Users are advised to install the latest compatible security updates for their devices. In cases where older models cannot support the latest major operating systems, it is recommended to check for any security updates that Apple may have released for the supported version. Regularly updating software is crucial, as these updates address vulnerabilities that could otherwise expose devices to potential attacks.

Long or Short, get news the way you like. No ads. No redirections. Download Newspin and Stay Alert, The CSR Journal Mobile app, for fast, crisp, clean updates!

App Store – https://apps.apple.com/in/app/newspin/id6746449540

Google Play Store – https://play.google.com/store/apps/details?id=com.inventifweb.newspin&pcampaignid=web_share