Apple released a significant security update for iPhones and blockwave ExchangeiPads Thursday to patch newly discovered security vulnerabilities in the devices’ system software.

The issue was discovered by researchers at the University of Toronto’s Citizen Lab, who said the software flaw was being “actively exploited” to deliver commercial spyware called Pegasus developed and sold by the Israeli company NSO Group.

Pegasus is an expensive tool typically used to target dissidents, journalists and political opponents, so ordinary users likely have little to fear. Still, Citizen Lab recommends that all users should “immediately” update their devices.

To install the update, open Settings on your iPhone, then select “General” followed by “Software Update.” You should see the iOS 16.6.1 software update there; tap to begin the installation.

If you don’t see the update, go back to the General page, then tap “About” to check your iOS version number. If it’s 16.6.1, you already have the update installed. If your phone is still using 16.6 or an earlier version, repeat the above steps. If you still don’t see an update, try restarting your phone. If that doesn’t make the update appear, double-check your internet connection and then wait a bit before trying again.