The demonstration suggests Lockdown Mode, built for users at risk of mercenary spyware, does not fully block this attack path, though Calif is reporting the flaws to Apple rather than publishing a tool.
Devices on older releases also receive patches, including a zero-day Apple says was used in an extremely sophisticated attack.
The bugs remain unexploited so far, but AI is shortening the time between disclosure and attack for under-resourced teams.
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
Operators running PHP 8.1 or older face the most pressing risk, since no official fix is coming for those versions.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.