Apple Releases Security Update for Older iPhones and iPads After Coruna Exploit

Apple has released security updates for older iPhones and iPads to address vulnerabilities targeted by the Coruna exploit kit, which has been used in cyberespionage and cryptocurrency theft attacks since February 2025. The patches cover devices that cannot run the latest iOS version and are not eligible for earlier fixes applied to newer hardware.

"This update brings that fix to devices that cannot update to the latest iOS version," Apple stated in the security advisories published Wednesday.

Apple Patches Coruna Exploits Used in Real Attacks Since Early 2025

The Coruna exploit kit has been linked to several attack campaigns since early 2025. Security researchers say it includes multiple exploit chains capable of gaining remote code execution or kernel-level privileges on vulnerable devices.

Apple’s updates address several vulnerabilities targeted by the framework, including:

• CVE-2023-41974: Kernel use-after-free vulnerability fixed with improved memory management
• CVE-2024-23222: WebKit type confusion issue addressed with improved checks
• CVE-2023-43000: WebKit use-after-free vulnerability
• CVE-2023-43010: WebKit memory handling flaw

Many of these issues were previously fixed in newer versions of iOS but had not yet been patched on older devices.

Devices Affected by the Coruna Exploit Kit

The updates apply to devices running iOS 15.8.7 and iPadOS 15.8.7, as well as iOS 16.7.15 and iPadOS 16.7.15. Affected hardware includes:

• iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPhone 8, iPhone 8 Plus, and iPhone X
• iPad Air 2, iPad mini (4th generation), iPad (5th generation), iPad Pro 9.7-inch, iPad Pro 12.9-inch (1st generation), and iPod touch (7th generation)

Three Threat Groups Using the Coruna Exploit Kit

According to Google Threat Intelligence Group (GTIG), the Coruna exploit kit has been used by at least three distinct threat groups since February 2025. These include a suspected Russian state-backed group tracked as UNC6353, a surveillance vendor customer, and a financially motivated Chinese threat actor tracked as UNC6691.

UNC6691 deployed the exploit kit through fake gambling and cryptocurrency websites to deliver malware that stole cryptocurrency wallet data from infected devices.

CISA Orders U.S. Agencies to Patch Coruna-Exploited Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added several vulnerabilities exploited by Coruna to its Known Exploited Vulnerabilities catalog.

Federal agencies have been ordered to apply the patches to affected devices by March 26 to reduce the risk of compromise. Apple recommends that users update their devices as soon as possible to ensure they are protected against these vulnerabilities through Settings > General > Software Update.

Apple has not indicated whether further backported patches for this exploit kit are planned.