Apple has released security patches for three critical zero-day vulnerabilities, including one exploited by the NSO group’s infamous Pegasus spyware tracked as CVE-2021-30869. These vulnerabilities exist in both iOS and macOS devices running older versions of the operating systems. CVE-2021-30869, is a type of confusion vulnerability that could allow a malicious application to execute arbitrary code with administrator privileges. The other two vulnerabilities are tracked as CVE-2021-30858 and CVE-2021-30860, and were disclosed by the University of Toronto’s Citizen Lab to be exploited in an attack that they dubbed “FORCEDENTRY” (aka Megalodon), a zero-click vulnerability that executes itself on target devices without any interaction from the victim. The patches are for computers and mobile devices utilizing macOS Catalina and iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation) running iOS version 12.5.4. These patches come right as three new zero-day exploits are identified with in Apple’s operating systems, and the Ankura CTAPT will be following the matter to provide updates to our readers as more information is released.