Apple has patched an actively exploited critical iOS zero-day vulnerability affecting older models of the iPhone, iPad, and iPod touch devices. The flaw, tracked as CVE-2022-42856, is described as a type confusion bug impacting the browser engine in Apple’s Webkit browser. Attackers could exploit this flaw by socially engineering a victim into clicking a link to a maliciously crafted actor-controlled website. Successful exploitation would give attackers the ability to conduct arbitrary remote code execution (RCE) on the vulnerable operating system, from which they could perform further malicious activity like moving laterally across the network, creating privileged user accounts, and dropping malware or ransomware payloads. Due to its active exploitation, The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerability (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies patch the flaw no later than January 4, 2023. At this time, Apple has not released the technical details of the exploit, allowing as many of their users to upgrade their operating systems as possible. With the exploitation relying on an older model iOS device, it is likely that any active exploitation attempts were highly targeted. That being said, CTIX analysts urge any and all iOS customers still using the devices listed in Apple’s advisory, to upgrade their operating systems immediately to prevent exploitation.