The first, surprisingly enough, revolves around two emojis. If you send someone a white flag emoji, followed by the number zero, followed by a rainbow emoji, it will cause the device to hang, and then, ultimately, to crash.
Apple posted an official explanation for the behavior, which is as follows:
What you see in the text is the waving white flag emoji, a zero, and the rainbow emoji. The rainbow flag emoji isn’t an emoji in itself, it’s made of three characters: waving white flag, a character called variation sector 16 (VS16 for short), and the rainbow. What VS16 does in this case essentially is tells the device to combine the two surrounding characters into one emoji, yielding the rainbow flag (this is similar to how skin tone modifiers work, but not exactly the same). The text you’re copying is actually waving white flag, VS16, zero, rainbow emoji. What I’m assuming is happening is that the phone tries to combine the waving white flag and the zero into an emoji, but this obviously can’t be done. Usually the phone wouldn’t try to do this, but it notices that the rainbow emoji is also there, and knows that it can combine the white flag and rainbow emoji, so it tries.
The second method is somewhat more involved, but the result is the same. To execute it, you create a new contact card, and fill it with those same three characters multiple times. Then, you send the card to a user.
That user does not even have to open it, or take any action for it to have the effect of crashing their device.
In both cases, Apple has announced that they’re working on a patch to fix this most recently identified security issue, so stay tuned for updates and patch accordingly. In the meantime, be aware that something as innocuous as a pair of emojis can crash your device.