Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

I already updated my phone. Is the iOS update that patches this available over a cell network? If not, as is usually the case, isn't that Not Good?

10.3.3? "This update requires a Wi-Fi network connection to download." Frustrating. I read this update may be 80-100 MB. Apple, please let me use my mobile data as I see fit. (And a security patch is certainly a worthy use!)

Agree, this is irresponsible to not let us update over cellular

I'm currently on vacation, which means that most of the wifi hotspots I'm connecting to are public. That's a big security risk in itself

iOS security update files are crypto signed, so it's safe to download them on public WiFi.

Not in this case.

If your wifi chipset is known to be compromised, and there is a remote exploit available, as in this case, then merely connecting with wifi to an evil hotspot is enough to compromise a device.

Once a device's been compromised, crypto signatures on update files won't protect you, as the signature checking itself can no longer be trusted.