Apple has patched a decade-old zero-day vulnerability in iOS that may have been exploited by commercial spyware. The security flaw, tracked as CVE-2025-3456, affects devices running iOS 16 and earlier versions. Security researchers discovered the vulnerability during routine code audits and immediately reported it to Apple's security team.

The exploit allowed attackers to execute arbitrary code with kernel privileges, potentially giving them complete control over compromised devices. Commercial spyware vendors were likely aware of this vulnerability for years, using it to target journalists, activists, and political figures. Apple's patch comes as part of iOS 17.3.1, released earlier this week.

This discovery highlights the ongoing challenges in securing mobile operating systems against sophisticated adversaries. The vulnerability's decade-long lifespan demonstrates how even the most scrutinized codebases can harbor critical flaws. Security experts recommend all users update their devices immediately to protect against potential exploitation attempts.