UPDATE: The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new critical Apple WebKit vulnerability to its binding operational directive (BOD 22-01) vulnerability catalog. This vulnerability affects iPhones, iPads, and MacOS computers. BOD 22-01 was issued in November of 2021 and stipulates that all Federal Civilian Executive Branch Agencies (FCEB) agencies must patch the cataloged security flaws no later than February 25, 2022. The vulnerability, tracked as CVE-2022-22620, is a use-after-free (UAF) flaw that if exploited, would allow attackers to execute arbitrary code on victim devices after tricking the users into opening maliciously crafted web sites using the Safari engine. The successful exploitation of this vulnerability could also lead to a full crash of the target’s operating system. This flaw is not limited to Safari and affects all internet browsers since they all use the open-source Safari engine to some capacity. This UAF vulnerability has been mitigated in Apple’s latest operating system updates by improving memory management. Users are urged to update to iOS 15.3.1, iPadOS 15.3.1, and macOS Monterey 12.2.1 immediately. The Ankura CTIX will continue to follow the movement on BOD 22-01, and further pertinent updates will be reported in later issues.