Apple has released an emergency security update that patches three (3) critical zero-day vulnerabilities, exploited to deliver the Cytrox-owned “Predator” spyware suite to monitor the iPhone of an Egyptian opposition politician, and former member of Parliament named Ahmed Eltantawy. The first flaw, tracked as CVE-2023-41993, is a remote code execution vulnerability in the Webkit browser engine impacting the Safari browser, which could be exploited via maliciously crafted webpages. The second vulnerability, tracked as CVE-2023-41991, is a Proxy Auto-config (PAC) flaw in the iOS Security framework, which could be exploited by attackers to bypass signature validation via the use of malicious applications. The third flaw, tracked as CVE-2023-41992, is a local privilege escalation (LPE) vulnerability in the XNU Kernel Framework, which is responsible for providing APIs, kernel extensions, and driver support. These vulnerabilities were exploited to allow the targeting of Eltantawy’s iPhone with SMS and WhatsApp messages carrying malicious Predator spyware links. When Eltantawy clicked the malicious links in the messages, he was automatically redirected to the malicious website hosting the Predator spyware. At this time, the activity has not been attributed to a specific entity. The vulnerabilities have been patched and all iPhone users should ensure that they are running the latest version of iOS to prevent exploitation.