Technology
Apple's iOS vulnerability exposes iPhones to stealthy hacker attacks
Generally, iPhones are considered more secure than Android devices.
Apple’s closed ecosystem and strict App Store policies limit the risk of malware, and its centralized software updates ensure better security. In contrast, Android’s openness allows users to install apps from various sources, and updates are often rolled out at different times, making it more vulnerable to attacks.
However, iPhones aren’t immune to security flaws. Hackers occasionally find ways to exploit them, as seen in Apple’s latest advisory. The company recently discovered that a vulnerability in iOS had been exploited for over a year. While a fix has now been released, reports suggest that hackers may have already targeted high-value individuals.
GET SECURITY ALERTS, EXPERT TIPS — SIGN UP FOR KURT’S NEWSLETTER — THE CYBERGUY REPORT HERE
A woman on her iPhone. (Kurt “CyberGuy” Knutsson)
What you need to know
Apple has uncovered hackers exploiting a vulnerability in iOS that appears to have been lingering for more than a year. The vulnerability is a “zero-day” flaw, meaning criminals may have already exploited it, according to the latest security advisory from the company. Zero-day flaws like this are especially dangerous because they are exploited before developers can issue fixes. Apple confirmed this marks its first zero-day patch of 2025. The vulnerability affects iPhones dating back to 2018’s XS model, as well as newer iPads, Macs, and even the Vision Pro headset.
The vulnerability, tracked as CVE-2025-24085, resides in Apple’s Core Media framework, a software layer responsible for processing multimedia files. A “use after free” memory corruption error enabled hackers to manipulate the system into executing unstable code, granting them elevated privileges to bypass security protocols. Apple’s advisory suggests hackers weaponized the flaw through malicious apps disguised as legitimate media players. These apps likely abused the Core Media framework by triggering corrupted files, enabling attackers to infiltrate devices.
The attacks reportedly targeted iOS versions predating 17.2, released in December 2023, meaning the vulnerability may have been active since late 2022. Security experts speculate that hackers focused on high-value individuals — such as activists, executives or journalists — to avoid detection. The prolonged stealth of the campaign underscores the challenges of identifying sophisticated, narrowly tailored exploits.
This underscores the critical need for you to update your devices to iOS 17.2 or later, as these versions include essential fixes to safeguard against this actively exploited vulnerability.
Apple’s iOS 17.2 update included patches for several vulnerabilities. (Kurt “CyberGuy” Knutsson)
HOW TO PROTECT YOUR IPHONE & IPAD FROM MALWARE
Apple’s response to the vulnerability
In response, Apple has released fixes across its ecosystem, including iOS 18.3, macOS Sequoia, watchOS, tvOS and VisionOS. You should update your devices as soon as possible to stay protected. To install the update on your iPhone or iPad:
- Go to Settings.
- Tap General.
- Click Software Update.
- Click Update Now or Update Tonight.
Pro Tip: I recommend you click Update Now and also turn on Automatic Updates to stay covered in the future.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
Steps to update software on an iPhone. (Kurt “CyberGuy” Knutsson)
While Apple has patched this issue, it’s a reminder that staying on top of updates is key. Hackers are always looking for security gaps, so keeping your software up to date is one of the best ways to stay safe.
SCAMMERS FOUND A SNEAKY WAY TO BYPASS YOUR IPHONE’S SAFETY FEATURES
7 ways to keep your iPhone safe
Protecting your iPhone requires proactive security measures. By following these seven essential steps, you can significantly reduce the risk of cyber threats and keep your personal information secure.
1. Keep your iPhone updated: I can’t say this enough. Updating your iPhone regularly is one of the most effective ways to protect it from security threats. Apple frequently releases updates that fix vulnerabilities, including critical zero-day flaws.
2. Download apps only from the App Store: To minimize the risk of installing malware, only download apps from the official App Store. Apple’s strict app review process helps prevent malicious apps from being published, but some threats can still slip through. Always verify app details, check reviews and be cautious about app permissions before installation.
3. Enable lockdown mode for extra protection: For those of you who may be at higher risk, such as journalists or executives, Lockdown Mode provides an additional layer of security. This feature limits certain device functionalities to prevent sophisticated cyberattacks. It can be turned on via Settings > Privacy & Security > Lockdown Mode and is especially useful for those concerned about targeted threats.
4. Enable message filtering: Use your device’s built-in filtering options to sort messages from unknown senders. This feature allows you to automatically sort messages from unknown senders, easily filter unread messages and manage your message inbox more efficiently. Here are steps:
- Open Settings.
- Scroll down and click Apps.
- Tap Messages.
- Turn on Filter Unknown Senders
5. Stay cautious of phishing attacks and install strong antivirus software: Phishing remains one of the most common tactics used by hackers. Be cautious when receiving unsolicited messages or emails on your iPhone, especially those with suspicious links or attachments. Always verify the sender before opening anything. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
6. Review your security and privacy settings: Regularly reviewing your iPhone’s security settings can help you maintain strong protection. You should also review app permissions in Settings > Privacy & Security to restrict access to sensitive data, such as location or contacts. Enable Face ID or Touch ID for secure access and turn on two-factor authentication (2FA) for Apple ID and other accounts. 2FA adds an extra layer of security to your accounts by requiring a second form of verification, such as a text message or authentication app, in addition to your password. This significantly reduces the risk of unauthorized access, even if your password is compromised.
7. Invest in personal data removal services: By reducing your online footprint, you make it harder for cybercriminals to obtain your contact information, potentially preventing them from sending you deceptive phishing texts and emails in the first place. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.
Kurt’s key takeaway
This iOS vulnerability is a serious reminder of the importance of staying up to date with software updates. If you’re using an iPhone from 2018 or later, make sure you’ve updated to iOS 17.2 or later as soon as possible. Hackers exploited a hidden flaw for over a year, using fake media apps to gain access to devices. While Apple has now patched the issue, the fact that it remained undetected for so long is concerning.
Do you think companies like Apple are doing enough to protect you from cyber threats? Let us know by writing us at Cyberguy.com/Contact
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
Google has finally killed the Stadia Bluetooth tool — but this person rescued it
Christopher Klay, who previously developed the Stadia Enhanced browser extension, is one of many who saved a copy of the tool to a personal GitHub page. What’s more, they’re hosting a working copy of that Google website right here to make it even easier.
Technology
Illinois DHS data breach exposes 700K residents’ records
NEWYou can now listen to Fox News articles!
Illinois residents are once again being reminded how fragile government data systems can be. The Illinois Department of Human Services has confirmed a data breach that exposed sensitive records belonging to roughly 700,000 people.
The breach is believed to have exposed two distinct sets of records. One is personal and program-related data tied to more than 672,000 Medicaid and Medicare Savings Program recipients, including addresses, case numbers, demographic details and medical assistance plan names, and another 32,000 Division of Rehabilitation Services customers whose names, addresses, case details and referral information were also exposed over multiple years.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
FIBER BROADBAND GIANT INVESTIGATES BREACH AFFECTING 1M USERS
The Illinois Department of Human Services confirmed a data breach that exposed sensitive records tied to roughly 700,000 residents, including Medicaid and disability services recipients. (Jakub Porzycki/NurPhoto via Getty Images)
What happened in the Illinois DHS data breach
As spotted by Bleeping Computer, the Illinois Department of Human Services disclosed that unauthorized access to one of its systems led to the exposure of records tied to approximately 700,000 Illinois residents. The affected data was connected to individuals who interacted with DHS programs, which can include benefits, assistance services and support programs across the state.
According to the agency, the breach involved personally identifiable information. While officials have not publicly released every technical detail, DHS confirmed that sensitive records were accessed, prompting notifications to impacted individuals. As is typical in cases like this, the investigation is ongoing, and the full scope of how the intrusion occurred is still being reviewed.
For residents, the key issue is not just that data was accessed, but the type of data DHS holds. Government agencies like DHS often store names, addresses, dates of birth, case numbers and, in some instances, Social Security numbers or benefits-related information. Once that data escapes, it can be misused in ways that last for years.
Why breaches like this are especially risky
When a private company is breached, you can often change a password or close an account. Government data is different. You can’t change your Social Security number easily. You can’t erase past interactions with public assistance programs. That makes breaches involving state agencies particularly dangerous.
Exposed records can be used for identity theft, fraudulent benefit claims, phishing scams and long-term impersonation. Criminals often combine government data with information from other breaches to build detailed profiles that make scams far more convincing. Even if there’s no immediate misuse, stolen data frequently resurfaces months or years later.
As with many large breaches, DHS has stated that it is taking steps to secure its systems and prevent similar incidents in the future. That’s an expected response. But for affected residents, the burden of protection now shifts largely to you.
We reached out to the Illinois Department of Human Services for comment, but did not receive a response before our deadline.
JANUARY SCAMS SURGE: WHY FRAUD SPIKES AT THE START OF THE YEAR
Personal information from Illinois DHS programs was accessed without authorization, raising concerns about long-term identity theft and fraud risks. (Philip Dulian/picture alliance via Getty Images)
7 steps you can take to stay safe after the Illinois DHS breach
If you received a notification from Illinois DHS, or if you’ve ever interacted with DHS programs, these steps can help reduce your risk.
1) Enroll in identity theft protection if it’s offered
If DHS provides free identity monitoring or credit protection, sign up. These services can alert you to suspicious activity involving your Social Security number or credit file before the damage spreads. Beyond basic monitoring, full identity theft services can help with recovery, paperwork and financial reimbursement if fraud occurs. This can be especially useful after large-scale government breaches.
Identity Theft companies can monitor personal information like your Social Security number, phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.
2) Use a password manager immediately
A password manager helps you create and store strong, unique passwords for every account. If your personal data is leaked, attackers often try the same credentials across multiple services. Unique passwords stop one breach from turning into many.
Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
3) Run strong antivirus software on your devices
Strong antivirus tools do more than scan files. They monitor suspicious behavior, phishing attempts and malicious links that often follow large data breaches. This matters because breach victims are frequently targeted with follow-up scams.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
4) Place a fraud alert or credit freeze on your credit file
A fraud alert tells lenders to verify your identity before opening new accounts. A credit freeze goes further by blocking new credit entirely unless you lift it. If Social Security numbers were exposed, a freeze is often the safest option.
5) Use a personal data removal service
Once your information leaks, it often spreads to data broker sites that sell personal details. Personal data removal services work to request takedowns and reduce how much of your information is publicly available. While they can’t erase everything, they significantly lower your exposure.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
6) Watch for phishing and impersonation scams
After breaches involving government agencies, scammers often pretend to be state officials, benefits offices, or support hotlines. Don’t click links or share information unless you independently verify the source through official websites or phone numbers.
7) Review your credit reports regularly
You’re entitled to free credit reports from major credit bureaus. Check them for unfamiliar accounts, inquiries or address changes. Early detection makes identity theft far easier to contain.
COVENANT HEALTH DATA BREACH AFFECTS NEARLY 500,000 PATIENTS
State officials say the breach involved Medicaid, Medicare Savings Program and rehabilitation services records spanning multiple years. (Silas Stein/picture alliance via Getty Images)
Kurt’s key takeaway
Even government agencies are not immune to large-scale security failures. When nearly 700,000 residents are affected, the impact goes far beyond a single system or department. While DHS works through its investigation, protecting your identity now depends largely on the steps you take next. Acting early, layering protections and staying vigilant can make the difference between a breach being an inconvenience or a long-term nightmare.
Do you trust state agencies to protect your personal data? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Roland’s Go:Mixer Studio turns your phone into a mobile music studio
Roland now offers a more capable audio mixer for phones and tablets with the launch of the Go:Mixer Studio. The Go:Mixer audio interface lineup has always been a bit limited, better suited for scrappy live streams and capturing quick demos on their phones than professional recording. The Go:Mixer Studio is an attempt to actually reach that lofty goal, with more inputs and outputs, built-in effects, and up to 24-bit / 192kHz audio. There’s even an iOS app that allows you to capture video and multitrack audio simultaneously.
Streaming and social video are still the major use cases here. The Go:Mixer Studio can even be mounted on a mic stand so you can keep it in easy reach during a live session. The screen and knobs allow you to control all the parameters on the Go:Mixer Studio directly, but there’s also a desktop app for Windows and MacOS that gives you complete control of the mixer remotely.
There’s plenty of connectivity, including two XLR inputs on the back with phantom power, a 1/4-inch instrument input for directly connecting a guitar or bass, stereo 1/4-inch line-in jacks, and an aux input. There’s also 1/8-inch TRS MIDI in and out, two headphone jacks, and stereo line outs for connecting to studio monitors. Each audio input has a dedicated EQ and compressor on the channel. The XLR and instrument ins also have reverb available.
The Go:Mixer Studio is available now for $299.
-
Sports2 days agoMiami’s Carson Beck turns heads with stunning admission about attending classes as college athlete
-
Detroit, MI6 days agoSchool Closings: List of closures across metro Detroit
-
Lifestyle6 days agoJulio Iglesias accused of sexual assault as Spanish prosecutors study the allegations
-
Education1 week agoVideo: Violence at a Minneapolis School Hours After ICE Shooting
-
Oklahoma1 week agoMissing 12-year-old Oklahoma boy found safe
-
Culture1 week agoTry This Quiz on Myths and Stories That Inspired Recent Books
-
Politics1 week agoSan Antonio ends its abortion travel fund after new state law, legal action
-
Education1 week agoVideo: Lego Unveils New Smart Brick