Apple WebKit Bugs Behind the Coruna iOS Exploit Kit
All three are fixed on current builds, but Coruna moved from spyware customers to mass scam sites and iOS 15 devices got two of these fixes only in March 2026, so find any device still behind.
Must act: Anyone with iPhones or iPads below iOS 17.3 (on 17), 16.7.5 (on 16) or 15.8.7 (on 15), Macs below Sonoma 14.3, Ventura 13.6.4 or Monterey 12.7.3 without Safari 17.3, or WebKitGTK or WPE WebKit below 2.42.5.
Can relax: Devices on current Apple releases (iOS 26.7.1 or 27.x, 18.7.10, 16.7.16 or 15.8.8) and Macs on Sonoma 14.3 or later, Ventura 13.6.4 or later or Safari 17.3 or later, which carry all three fixes.
- Pull an OS version report from MDM and flag iPhones and iPads below iOS 17.3 (on 17), 16.7.15 (on 16) or 15.8.7 (on 15).
- Update flagged devices to the newest build they support: iOS 26.7.1 or 27.0.1, 18.7.10, 16.7.16 or 15.8.8.
- Check Macs with sw_vers -productVersion and the Safari version; flag Sonoma below 14.3, Ventura below 13.6.4 and Monterey below 12.7.3 unless Safari is 17.3 or later.