The Project Pegasus

They mention a zero click solution. Does that mean simply receiving those iMessages itself would open up the phone or the user had to click those links?
iMessage runs some complex parsing code on the messages it receives. Attacker will send you an image or something, That code will run automatically and end up exposing your device to the attacker. You don't have to do anything.

This was even worse before iOS 14. After iOS 14, They tried to fix this by making a BlastDoor process that was a isolated process with very limited privilege. This process would do all the parsing. The idea was that, By parsing untrusted data in a separate isolated process, They can improve security of the device but this vulnerability shows they weren't successful and even after all this effort, iOS 14.6 is still vulnerable.

also just random info...

There is a company that buys zero days like this(Zerodium). 0 Click 0 days go for 2M USD, 1 click 0 days go for 1M USD. They have a whole chart somewhere.
 
Back