SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Fixes Critical Zero-Day Flaws

Apple released May 2021 zero-day exploit security updates for multiple products, including Safari, macOS, iOS, iPadOS, tvOS and watchOS. Apple Zero Day Exploit of some of these security flaws will allow an attacker to take control of the victim’s system and put Mac users at great risk. However, a vu

May 5, 20212 min read

Apple released May 2021 zero-day exploit security updates for multiple products, including Safari, macOS, iOS, iPadOS, tvOS and watchOS. Apple Zero Day Exploit of some of these security flaws will allow an attacker to take control of the  victim’s system and put Mac users at great risk. However, a vulnerability management tool can mitigate these.

The updates for Apple products include fixes for 4 vulnerabilities, including two zero-days. These flaws allow attackers to corrupt memory, execute arbitrary code, and even control the affected device. All these flaws are observed to be actively exploited by attackers. To avoid these flaws, we can use a patch management tool.

Zero-Day ( CVE-2021-30665 )

A critical zero-day vulnerability residing in the Webkit browser engine of iOS is fixed in this May update. The vulnerability is due to a memory corruption issue related to improper state management. Also, the vulnerability allows an attacker to remotely execute commands on vulnerable devices simply by visiting a malicious website. The vulnerability is discovered and reported by security researchers from China. The new release of 14.5.1 is mitigating this issue along with other bugs.

Zero-Day ( CVE-2021-30663 )

One more critical zero-day vulnerability residing in the Webkit browser rendering engine of iOS is also fixed in this security update. The vulnerability is due to an integer overflow issue related to improper input validation. It allows attackers to conduct remote code execution on iPhones, iPads, iPods, macOS, and Apple Watch devices. An anonymous source is behind the discovery of this 0-day.

Apple Security Updates Summary for May 2021

macOS

Safari

iOS and iPadOS

  • Product: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
  • Affected features: WebKit
  • Impact: Arbitrary code execution
  • CVEs: CVE-2021-30665, CVE-2021-30663

iOS

watchOS

  • Product: Apple Watch Series 3 and later
  • Affected features: WebKit
  • Impact: Arbitrary code execution
  • CVEs: CVE-2021-30665

Moreover, Apple Zero Day Exploit affected these products.

Also, SanerNow detects these vulnerabilities and automatically fixes them by applying security updates. Furthermore, Use SanerNow to keep your systems updated and secure.

Featured Posts

Open F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws
vulnerability researchF5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

CVE Research

F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

Oct 19, 2026

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026

Open Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

CVE Research

Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.

Oct 16, 2026

Open Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution
vulnerability researchPalo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

CVE Research

Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Oct 15, 2026