The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered all Federal Civilian Executive Branch (FCEB) agencies to patch a critical Apple zero-day vulnerability by no later than September 11, 2025, after confirming it is being actively exploited in targeted attacks. The flaw, tracked as CVE-2025-43300, is rated 8.8/10 in severity, affecting the ImageIO framework used across iPhones, iPads, and Macs, and can be triggered in a zero-click manner by simply processing a maliciously crafted image. Apple acknowledged that the exploit has been leveraged in “extremely sophisticated attacks against specific targeted individuals,” echoing past incidents like the BLASTPASS chain that enabled Pegasus spyware. Security researchers warn that while the average user is unlikely to be targeted, the vulnerability highlights a persistent threat from spyware vendors and state-linked actors, underscoring the urgency of applying Apple’s latest patches. CTIX analysts urge all Apple users to turn automatic updates on their devices, and always ensure that they are staying up-to-date with the latest security updates.