Apple has issued a software patch to block so-called "zero-click" spyware that could infect iPhones and iPads.
Independent researchers identified the flaw, which lets hackers access devices through the iMessage service even if users do not click on a link or file.
The problem affects all of the technology giant's operating systems, the researchers said.
Apple said it issued the security update in response to a "maliciously crafted" PDF file.
University of Toronto's Citizen Lab, which first highlighted the issue, had previously found evidence of zero-click spyware, but "this is the first one where the exploit has been captured so we can find out how it works," said researcher Bill Marczak.
The researchers said that the previously unknown vulnerability affected all major Apple devices, including iPhones, Macs and Apple Watches.
Citizen Lab also said the security issue was exploited to plant spyware on a Saudi activist's iPhone, adding that it had high confidence that the Israeli hacker-for-hire firm, NSO Group, was behind that attack.
In a statement to the Reuters news agency, NSO did not confirm or deny that it was behind the spyware, saying only that it would "continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime".
Security experts have said that although the discovery is significant, most users of Apple devices should not be overly concerned as such attacks are usually highly targeted.
Apple said in a blog post that it had issued the iOS 14.8 and iPadOS 14.8 software patches after it became aware of a report that the flaw "may have been actively exploited".
The announcement came as the technology giant prepared to unveil new devices at its annual launch event on Tuesday.
The company is expected to reveal new iPhones and updates to its AirPods and Apple Watch.
Apple's iMessage is one of the most secure messaging apps in the world but clearly it had a dangerous weakness that a hacking team found and exploited.
The news will embarrass Apple which prides itself on being a secure and safe system.
The revelation is potentially another blow to the reputation of NSO Group which is still reeling from recent accusations of widespread spy hacks on innocent people.
It also highlights once again that no device is fully safe if a determined, well-funded team wants to hack it and is paid enough to do so.
The good advice from all corners is for iOS users to update the security software of their devices as soon as possible to patch up the security hole.
But for the vast majority of users, the risk of being a target of this expensive and highly-skilled hacking, is low.
Motorcycles can break iPhone cameras, Apple warns
Apple dealt major blow in Epic Games trial
Apple chief executive Tim Cook gets $750m payout
Four more small energy firms could go bust next week
Rising wholesale gas prices means some companies are unable to supply energy customers have paid for.
Girls excluded as Afghan secondary schools reopen
Holiday bookings surge after travel rules change
Strictly 2021: Dragons, dad dancing and 'Stricky-Leaks'
What are the new rules for going abroad?
The moment QAnon took the person I love most
How Germany's Merkel shaped a generation
Ros Atkins On… the ethics of Covid booster jabs. Video
What are puberty blockers?
Should green campaigners ramp up pressure on China?
The escape of the whirling dancer. Video
Want some autumn sun? Your travel guide to the Med
Can’t face cutting down on your favourite foods?
Why simply changing your mealtimes can help with weight loss
Meet the Khans
Inside their crazy, fabulous and fast-paced life in their beloved Bolton home
Boxer Amir Khan removed from US flight1
Four more energy firms could go bust next week2
Strictly champ goes for hat-trick with rugby star3
Sunset bar defends £200 fee to deter instagrammers4
Girl, 2, dies after falling from pony at hunt meet5
Shocked couple find python in bedroom6
Girls excluded as Afghan secondary schools reopen7
Red Bull in trademark dispute with English gin firm8
Holiday bookings surge after travel rules change9
Strictly 2021: Dragons, dad dancing and 'Stricky-Leaks'10
An astonishing miscarriage of justice… iPlayer
Gripping drama with unexpected results. iPlayer
Could he have been stopped sooner? Audio
A murder investigation that sparked fury. Audio
© 2021 BBC. The BBC is not responsible for the content of external sites. Read about our approach to external linking.
