If you have a new iPhone or Mac, there are plenty of reasons to go update to iOS 18.4 or macOS 15.4, but users of older devices might not be so quick to hit the download button. But these updates are especially important—Apple has patched a pair of vulnerabilities originally fixed in iOS 18.3.1 and 18.3.2 and five dozen fixes for newer phones and Macs.

In iOS 16.7.11 (compatible with iPhones 6-13) and iOS 15.8.4 (compatible with iPhones 8-14), Apple issued a pair of security updates to fix zero-days previously exploited in the wild. Apple previously addressed the flaws in iOS 18.3.1 (Accessibility) and 18.3.2 (WebKit) for newer iPhones, but they remained exploitable in older phones until this week.

Apple also patched an actively exploited CoreMedia flaw in older iPads and Macs that was first fixed in iOS 18.3 and macOS 15.3.

Apple says the vulnerabilities were used in “extremely sophisticated” attacks, meaning hackers targeted high-level individuals in government or business. However, as long as the flaw remains open on your devices, there is still a risk that it could be exploited with lower-level malware, so we recommend updating as soon as possible. See our tests of the best Mac antivirus programs for more security options.

Apple also issued a few dozen security fixes for newer iPhones and Macs with iOS 18.4 and macOS 15.4, as well as updates to iPad, Apple Watch, Apple TV, and Vision Pro so no matter what Apple device you own, go update this weekend before it’s too late. 

If you’ve got a to-do list this weekend, we’ve got one more item for it: update your iPhone, iPad, and Mac. An update was released this week that patches a vulnerability first spotted way back in December 2023.

According to Apple’s release notes, the fix affects iOS 18, iPadOS 18, macOS 15, and visionOS 2, as well as Safari 18 for macOS Ventura and macOS Sonoma users. The release notes say the updates include unknown bug fixes, but the big reason to update is a single security update across all devices:

• Impact: Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)
• Description: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.
• WebKit Bugzilla: 285858
• CVE-2025-24201: Apple

Apple is credited with discovering the flaw, which was initially patched on December 11, 2023, with iOS 17.2 and macOS Sonoma 14.2. It’s unclear which WebKit patch fixed the original vulnerability.

So far this year, Apple has fixed three zero-days, which are defined as flaws that were previously unknown. While Apple’s language implies this threat was used in targeted attacks, you should definitely update your devices if you haven’t already.