A broker of software attacks that exploit vulnerabilities in widely used software is placing a $1 million bounty on critical iOS bugs that allow hackers to remotely commandeer iPhones and iPads.

"Apple iOS, like all operating system(s), is often affected by critical security vulnerabilities," officials with the Zerodium bug broker said in blog post published Monday that announced the hefty reward. "However, due to the increasing number of security improvements and the effectiveness of exploit mitigations in place, Apple's iOS is currently the most secure mobile OS. But don't be fooled, secure does not mean unbreakable. It just means that iOS has currently the highest cost and complexity of vulnerability exploitation and here's where the Million Dollar iOS 9 Bug Bounty comes into play."

Under the program, Zerodium is prepared to pay a total of $3 million for remote iOS exploits that give attackers complete control over a vulnerable device. Zerodium will pay $1 million to each person or team who creates and submits an exclusive browser-based attack that works on the latest-available version of the operating system. The program is scheduled to run through October 31, but it will be terminated earlier if three winning exploits are submitted sooner.

To qualify, the initial attack must work through:

a webpage targeting either the mobile Safari or Google Chrome browsers in their default configuration

a webpage targeting any app reachable through the browser or

a text message or a media file delivered through an SMS or MMS message.

The entire exploit process must be achievable remotely, reliably, surreptitiously, and without requiring any user interaction beyond browsing to a website or reading a text message. Attacks that require physical access to a targeted phone or connections through Bluetooth, NFC, or the baseband don't qualify, although Zerodium said it may, at its sole discretion, make offers to acquire such exploits. Exploits must also be exclusive and target previously unknown vulnerabilities.

The bounty program is believed to be the biggest ever announced. While $1 million is a huge sum, security experts say some of the most valuable exploits sold to governments and criminal hacking operations likely meet or exceed that amount. It wouldn't be surprising to see Zerodium make at least one $1 million payout in the next five weeks.