Pegasus spyware penetration into the phones

What are the facts that indicate penetration methods used by the Pegasus spyware on mobile phones?

How is penetration still possible when latest and up-to-date OS of the phone is used?