Apple pushed out iOS 15.6.1 last week and if you still haven't installed it, close this tab and go do that first. I'll wait.
Okay. Two things got patched, both already being exploited in the wild before Apple even shipped the fix. One's in WebKit, the browser engine every app on iOS has to use whether it wants to or not, thanks to Apple's own rules. The other is deeper, in the kernel itself, the kind of bug that lets an attacker who's already gotten in through the browser hole take over pretty much the whole device. Chain the two together and someone just has to get you to load a page. Not click anything. Not download anything. Just load it.
That's the part that gets me every time. We spend so much energy warning people about suspicious attachments and sketchy download links, and meanwhile the actual scary stuff increasingly doesn't need you to do anything except have Safari open. Or Chrome, or Firefox, or any browser on iOS, since they're all wearing a WebKit trenchcoat under the hood, App Store rules being what they are.
Apple's advisory was its usual masterpiece of saying nothing: "may have been actively exploited." No details on who, no details on how many people, nothing. Researchers who track this stuff for a living have pointed out before that this exact combination, a WebKit flaw paired with a kernel privilege escalation, tends to show up in the more expensive spyware operations, the ones aimed at journalists and activists rather than someone scrolling Instagram at a bus stop. Doesn't mean that's what happened here. Just means it's the kind of bug that's worth real money on the open market, which is its own kind of unsettling to sit with.
Anyway. I updated my phone standing in the kitchen at something like 11pm on a Wednesday, plugged into the charger because I stopped trusting the battery percentage after 9pm a long time ago, and it took maybe four minutes. My MacBook Air needed 12.5.1 too since it's the same underlying flaw, and that one I'd been putting off because I had eleven tabs open and didn't want to lose my place. Lost my place anyway. Worth it.
So here's the actual habit-forming part, since "just update it" is useless advice if you never actually do it.
iPhone or iPad: Settings, then General, then Software Update, then Automatic Updates. Turn on both toggles, the download one and the install one. Not just one. Mine was set to download-only for close to a year without me noticing, which meant updates just sat there waiting for me to remember they existed. Which I never did.
Mac: System Preferences, Software Update, then the little "Advanced" button almost nobody clicks. Check every box in there. Yes, even the one about installing system data files. That's the entire point of the box.
Chrome: it mostly updates itself quietly in the background, but the update only actually applies the next time you fully quit and relaunch the browser, which given how many tabs I keep open is basically never. Go to chrome://settings/help once in a while and let it force the check itself. Ten seconds, tops.
Your router: the one nobody does. Most consumer routers do not auto-update their firmware, full stop. Log into whatever admin panel your ISP handed you years ago and look for a firmware version number, then check it against the manufacturer's site. Mine was two years out of date. Two years.
None of this is exciting advice and I'm aware of that. But the boring stuff is the stuff that actually closes the hole. The interesting security writing is always about the exploit itself; nobody writes the fun article about the guy who turned on automatic updates back in 2019 and never thought about it again, because there's no story there. That's kind of the whole goal though, being the unremarkable device nobody bothers targeting because you're not worth the four minutes it'd take to break in through the more interesting method.
If you're on a phone old enough that 15.6.1 isn't even offered to you (anything before the 6S is out of luck here), that's a separate and worse conversation for another day. For now: update the phone tonight, update the laptop this weekend, and please, actually go check the router.