New OS X & Safari updates patch security exploit that allowed remote infiltration

Last week, Apple issued a surprise security fix for iOS that patched a vulnerability that allowed attackers to remotely gain control of a user’s device if they simply clicked a link. Now, Apple has issued the same security patch for users of OS X 10.11.6 El Capitan and 10.10.5 Yosemite.

The vulnerability has been named “Pegasus” and takes advantage of zero-day vulnerabilities to remotely jailbreak and install monitoring software on a user’s device, obviously without the user’s knowledge. Part of the exploit takes advantage of a memory corruption flaw in Safari WebKit that allows hackers to initiate the process of overtaking the operating system.

One of the nastiest aspects of this vulnerability is that it allows the attacker to intercept information from a variety of third-party apps and services, including Gmail, Facebook, Skype, WeChat, and more. These are, of course, in addition to first-party services like iMessage and FaceTime.

Last week, iOS 9.3.5 patched the same exploit. At the time, The New York Times described the exploit as an effort “to spy on dissidents and journalists.” Because the mobile and desktop versions of Safari share similar code, the exploit was essentially cross-platform.

Apple writes the following about the Safari 9.1.3 WebKit update on its support website: