#commercial-spyware

#commercial-spyware

Tracked as CVE-2026-20700, the zero-day flaw is described as a memory corruption issue that could be exploited for arbitrary code execution. It affects dyld (Dynamic Link Editor), the system component responsible for loading dynamic libraries into memory and which acts as a connector between application code and system frameworks. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26," Apple noted in its advisory.

The agency says the activity it's seeing suggests an increasing focus on "high-value" individuals - everyone from current and former senior government, military, and political officials to civil society groups across the US, the Middle East, and Europe. In many of the campaigns, attackers delivered spyware first and asked questions later, using the foothold to deploy more payloads and deepen their access.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday issued an alert warning of bad actors actively leveraging commercial spyware and remote access trojans (RATs) to target users of mobile messaging applications. "These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim's messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim's mobile device," the agency said.

Leadership changes at CISA, intended for modernization, are currently hindering federal cybersecurity progress as adversaries' tactics evolve faster than new policies can adapt.