Apple backports Coruna exploit-kit fixes to old iPhones with iOS 15.8.7 and 16.7.15

On 11 March 2026 Apple released iOS and iPadOS 15.8.7 and 16.7.15, bringing fixes for flaws used by the "Coruna" iOS exploit kit to devices that can't run current iOS. Coruna started out as a surveillance-grade tool and ended up stealing crypto from people who visited fake finance sites. If your organisation, your test-device drawer or your users still run iPhone 6s to iPhone X, this is the update that matters.

What happened

Google Threat Intelligence Group (GTIG) published research on Coruna on 3 March 2026. The kit contains five full exploit chains made up of 23 exploits and targets iPhones running iOS 13.0 through 17.2.1. GTIG tracked it through three phases:

• February 2025: parts of a chain captured from a customer of a commercial surveillance vendor.
• Summer 2025: UNC6353, a suspected Russian espionage group, used it in watering-hole attacks on Ukrainian websites through a hidden iframe.
• Late 2025: UNC6691, a financially motivated actor operating from China, deployed the full kit through fake financial and cryptocurrency websites. The final implant targeted crypto wallet apps.

GTIG said the kit does not work against the latest iOS, and that it stops if Lockdown Mode or private browsing is on. CISA added CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000 to its Known Exploited Vulnerabilities catalog on 5 March, with a 26 March deadline for federal agencies.

Apple's backports:

• iOS/iPadOS 15.8.7 fixes CVE-2023-41974 (kernel use-after-free that could give an app kernel privileges), CVE-2024-23222 (WebKit type confusion that could lead to code execution from web content), and CVE-2023-43000 and CVE-2023-43010 (WebKit memory corruption).
• iOS/iPadOS 16.7.15 fixes CVE-2023-43010.

Apple's notes say each fix is associated with Coruna and first shipped in iOS 16.6, 17, 17.2 or 17.3 between 2023 and early 2024.

Who is affected

• iOS 15.8.7: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), iPod touch (7th generation).
• iOS 16.7.15: iPhone 8, iPhone 8 Plus, iPhone X, iPad (5th generation), iPad Pro 9.7-inch, iPad Pro 12.9-inch (1st generation).
• Any device stuck on iOS 13.0–17.2.1 without these updates, including supported devices whose owners never upgraded.

What it means for developers and engineering teams

Coruna is a clear example of exploits being passed down. Chains built for targeted surveillance were resold or reused until they ended up in mass-market fraud. GTIG describes this as a market for "second-hand" zero-days. In practice, a bug that was a nation-state capability in 2023 can be used against ordinary users in 2025, which is why old, unpatched devices are the ones at real risk.

The chains follow the usual iOS pattern. A WebKit bug gives read/write access inside the browser's content process. A sandbox escape and a kernel privilege escalation (CVE-2023-41974 among them) follow, then a bypass of Page Protection Layer (PPL), Apple's kernel-integrity hardening. Every iOS browser uses WebKit, so simply visiting a malicious page is enough to start the attack. For web developers, this means a compromised site you run, or a third-party script on it, could become the watering hole. The Ukrainian campaign was a hidden iframe on legitimate sites.

For mobile teams, many companies keep old iPhones around for QA, kiosks or shared field devices, and those devices often sign into corporate accounts.

What to do now

1. Inventory iOS versions in your MDM. Flag anything below iOS 17.3 on supported hardware, and anything below 15.8.7 or 16.7.15 on legacy hardware.
2. Push the updates: 15.8.7 for iPhone 6s/7/SE (1st gen) class devices, 16.7.15 for iPhone 8/X class devices, and the current iOS release for everything else.
3. Enable Lockdown Mode on high-risk users' devices, and on any device that can't be updated.
4. Retire or isolate legacy test devices. Keep them off corporate SSO and off networks where they can reach production.
5. Harden your own sites against becoming a watering hole: use a strict Content-Security-Policy, Subresource Integrity on third-party scripts, and alerts for unexpected iframe or script injections.

Related on TechLogHub

• What is XSS?, one of the usual routes for injecting malicious iframes into legitimate sites
• What is a CDN?

Sources

• Apple: About the security content of iOS 15.8.7 and iPadOS 15.8.7
• Apple: About the security content of iOS 16.7.15 and iPadOS 16.7.15
• Google Threat Intelligence Group: Coruna, a powerful iOS exploit kit
• The Hacker News: Coruna iOS exploit kit uses 23 exploits
• SecurityWeek: Apple updates older iOS versions to patch Coruna exploits
• BleepingComputer: Apple patches older iPhones and iPads against Coruna exploits