Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware

Apple just slammed a door that’s been secretly open since the very first iPhone, patching a bug that Google says was used in “extremely sophisticated” attacks on specific targets. The fix landed in iOS 26.3, closing a flaw in the phone’s “doorman” (the app loader) that could be chained with browser tricks for near-total takeover. Sounds heroic… until the comments set the place on fire. One user declared their older iPad is “finally a brick,” furious there’s no update for iPadOS 17, while another says they trusted Apple and can’t believe data could be pulled from a locked phone. Ouch.

The term “zero-day” sparked a mini flame war: how can a decade-old bug be called “zero-day”? Cue explainers that it means attackers got in before there was a fix, not that the flaw is new. Meanwhile, someone joked the update was only for “Tahoe” (they meant iOS 18), turning version numbers into memes. The open source vs Apple feud also made a cameo, with cheers that Google’s researchers found the mess — “Open source wins… again.” Others tried calming the pitchforks, reminding everyone the attacks were targeted and not your average hacker next door. But the vibe remains: this patch is huge, and the trust hangover is real. Read Apple’s notes here and Google’s take here.