Apple security news · Threat Recapvendors/apple.htmlSecurity news, advisories and CVEs for AppleMon, 19 Oct 2026 12:28:44 GMT Cybercriminals favor Microsoft over Apple and Google in brand phishing attackshttps://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/yxl60qMon, 19 Oct 2026 09:38:17 GMTHelp Net Security. Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Top 10 most impersonated brands in phishing…Phishing The Dacls RAT ...now on macOS!https://objective-see.org/blog/blog_0x57.htmlmaxdzcSun, 18 Oct 2026 21:00:39 GMTObjective-See. A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.ResearchMalwareAPT Sniffing Authentication References on macOShttps://objective-see.org/blog/blog_0x55.html1knfaiqSun, 18 Oct 2026 21:00:39 GMTObjective-See. CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.ResearchVulnerability Pass the AppleJeushttps://objective-see.org/blog/blog_0x49.html1ayob0xSun, 18 Oct 2026 21:00:39 GMTObjective-See. A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!ResearchAPT Writing a File Monitor with Apple's Endpoint Security Frameworkhttps://objective-see.org/blog/blog_0x48.html1jpqds4Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!Research Writing a Process Monitor with Apple's Endpoint Security Frameworkhttps://objective-see.org/blog/blog_0x47.htmlvrs6wfSun, 18 Oct 2026 21:00:39 GMTObjective-See. Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!Research iOS 27.0.1 Untethered Jailbreak Demonstrated on iPhone 18 Prohttps://cybersecuritynews.com/ios-27-0-1-jailbreak-demonstrated/vj516gFri, 16 Oct 2026 12:21:57 GMTCybersecurity News. Security researchers from the cybersecurity firm Calif demonstrated a working untethered jailbreak for iOS 27.0.1 on Apple’s newest iPhone 18 Pro. The live demo took place at Hexacon 2026, the offensive security conference organized by Synacktiv in Paris on… Product showcase: GuardOS checks QR links, scans for data breaches, and filters Safari contenthttps://www.helpnetsecurity.com/2026/10/15/product-showcase-guardos/tcpowkThu, 15 Oct 2026 04:00:08 GMTHelp Net Security. GuardOS is an iPhone application that combines device security checks, VPN access, Safari content filtering, QR link scanning, and storage cleanup. It is available through the App Store. Getting started The home dashboard organizes tools into individual…Breach CVE-2026-0315 GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM)https://security.paloaltonetworks.com/CVE-2026-03151k2jvetWed, 14 Oct 2026 16:00:00 GMTPalo Alto Networks Advisories. AdvisoryVulnerability Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visithttps://cybersecuritynews.com/coruna-and-darksword/o1z40fWed, 14 Oct 2026 09:26:22 GMTCybersecurity News. Two powerful iPhone exploit kits, Coruna and DarkSword, show how a visit to a malicious or compromised website can put an outdated device at risk. The kits can link several software flaws together to break out of the browser and reach deeper parts of iOS.…Vulnerability ICMacOS Malware Evolves to Steal Credentials and Provide Persistent Remote Mac Accesshttps://cybersecuritynews.com/icmacos-malware-evolves/59i477Tue, 13 Oct 2026 13:52:36 GMTCybersecurity News. ICMacOS malware has grown from a tool that steals passwords and cryptocurrency wallet data into a remote access trojan that can keep attackers connected to infected Macs. Its newer version adds a live command channel and a startup mechanism, giving criminals…Malware Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detectionshttps://blog.virustotal.com/2026/10/introducing-macos-mirage.html.html1yok3nfTue, 13 Oct 2026 11:53:10 GMTVirusTotal Blog. In November 2015, we released our first in-house macOS sandbox, Box of Apples , followed by an update in March 2018 that introduced HTML behavior reports, desktop screenshots, and process trees. Over the past decade, the macOS ecosystem and the threat…Research P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commandshttps://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html1dw7824Sun, 11 Oct 2026 04:24:34 GMTThe Hacker News. Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet…Breach Podcast: Leak Show Cops Can Break into Locked iPhoneshttps://www.404media.co/podcast-leak-show-cops-can-break-into-locked-iphones/z3e8dmThu, 08 Oct 2026 16:11:25 GMT404 Media. Cops are getting around a very important iPhone security feature; someone made an LLM torture chamber; and lawyers going wild with ChatGPT.Breach Microsoft, Adobe, Apple, and Foxit vulnerabilitieshttps://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/1o45h3aWed, 07 Oct 2026 19:27:43 GMT0dayfans. Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s…AdvisoryVulnerability Apple’s Verified Photography Systemhttps://www.schneier.com/blog/archives/2026/10/apples-verified-photography-system.html301pwrWed, 07 Oct 2026 11:07:36 GMTSchneier on Security. Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other… SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mailhttps://seclists.org/fulldisclosure/2026/Oct/11imf19iTue, 06 Oct 2026 17:44:42 GMTFull Disclosure. Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 06 SEC Consult Vulnerability Lab Research Announcement < 20261001 > ======================================================================= title: Arbitrary Email sender spoofing in Apple…AdvisoryVulnerabilityLaw & policy Possible Vulnerability in Apple’s Automatic Reboothttps://www.schneier.com/blog/archives/2026/10/possible-vulnerability-in-apples-automatic-reboot.html3sazt5Tue, 06 Oct 2026 11:06:46 GMTSchneier on Security. 404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t…Vulnerability RemoveMacAI turns off Apple Intelligence on macOS 27 and deletes its modelshttps://www.helpnetsecurity.com/2026/10/05/removemacai-turn-off-apple-intelligence/1ukc1ioMon, 05 Oct 2026 12:26:49 GMTHelp Net Security. A developer has released RemoveMacAI, a free command-line tool that turns off Apple Intelligence on macOS 27 and deletes about 12 GB of downloaded AI models. It requires a Mac with Apple silicon. macOS 27 doesn’t have a switch for Apple Intelligence, and the… Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Accesshttps://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.html1jzyaeMon, 05 Oct 2026 10:38:50 GMTThe Hacker News (+1 more sources). Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents. "Some developers are using Full Disk Access in ways that could put users at…AI Apple changes full-disk access permissions to curb abuse from AI agentshttps://arstechnica.com/security/2026/10/apple-changes-full-disk-access-permissions-to-curb-abuse-from-ai-agents/rz6yuhFri, 02 Oct 2026 23:03:16 GMTArs Technica. Meta says FDA isn't sufficient to Muse reading messages. Apple begs to differ.AI Cisco IOS XE Software Security Hardening Release: August 2026https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XE%20Software%20Security%20Hardening%20Release:%20August%202026%26vs_k=11eo8w3iFri, 02 Oct 2026 19:21:28 GMTCisco Security Advisories. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple…AdvisoryVulnerabilityZero-day Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agentshttps://techcrunch.com/2026/10/02/apple-says-its-tightening-macos-full-disk-access-controls-due-to-new-risks-from-ai-agents/1chpo04Fri, 02 Oct 2026 18:11:27 GMTTechCrunch Security. Apple says it will add new controls around macOS’s Full Disk Access permission, warning that increasingly capable AI agents make broad access to users’ files, messages, mail, and browsing history riskier.AI CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installerhttps://www.infosecurity-magazine.com/news/cloudsyncd-macos-backdoor-fake/18u1y3wThu, 01 Oct 2026 13:30:00 GMTInfosecurity Magazine (+2 more sources). CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoorMalware Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claimshttps://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/7a2cqjThu, 01 Oct 2026 13:00:22 GMT404 Media. Magent Forensics, the owner of the GrayKey phone unlocking tool, says it can bypass an iPhone rebooting feature that was locking cops out.Breach Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950https://securityaffairs.com/200175/hacking/public-poc-released-for-apple-coregraphics-zero-day-cve-2026-86950.html11dhv3lThu, 01 Oct 2026 12:08:19 GMTSecurity Affairs. Apple patched a CoreGraphics zero-day that may have been exploited in targeted attacks. A public PoC for the flaw is now available. Apple patched a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that attackers may have exploited to target…VulnerabilityZero-day Mobile malware warning from Ukrainian researchers includes iPhone exploit kithttps://therecord.media/ukraine-ssscip-mobile-malware-warning-ios-androidtf8bnrWed, 30 Sep 2026 14:00:00 GMTThe Record. 'Hit and run' iPhone malware known as DarkSword is part of a wave of Russian attacks on iOS and Android devices, according to Ukraine's SSSCIP.Malware U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities cataloghttps://securityaffairs.com/200069/security/u-s-cisa-adds-apple-multiple-products-flaw-to-its-known-exploited-vulnerabilities-catalog.html1g3pwg1Wed, 30 Sep 2026 08:04:32 GMTSecurity Affairs. U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple Multiple Products flaw, tracked as…VulnerabilityZero-day Signal adds encypted local backup support to iOS, desktop appshttps://www.bleepingcomputer.com/news/security/signal-adds-encypted-local-backup-support-to-ios-desktop-apps/ub1xqTue, 29 Sep 2026 21:30:08 GMTBleepingComputer. Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). [...] Still running iOS 26? Update your iPhones, iPads, and Macs for this urgent security fixhttps://techcrunch.com/2026/09/29/still-running-ios-26-update-your-iphones-ipads-and-macs-for-this-urgent-security-fix/17ludbaTue, 29 Sep 2026 13:25:21 GMTTechCrunch Security. Apple says the bug was used to attack "specific targeted individuals" running iOS 26, which the majority of Apple customers are still using.Vulnerability Update your iPhone, iPad, or Mac: Flaw could run attackers’ codehttps://www.malwarebytes.com/blog/bugs/2026/09/update-your-iphone-ipad-or-mac-flaw-could-run-attackers-codev66a0rTue, 29 Sep 2026 10:35:16 GMTMalwarebytes Labs. A malicious file could trigger the vulnerability. Apple says it may already have been used against iPhone users.ResearchVulnerability Fake iPhone Duo preorder scam triggers DarkSword attackhttps://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attackjylj7tTue, 29 Sep 2026 09:56:49 GMTMalwarebytes Labs. A fake iPhone Duo preorder page promises a $500 voucher. Open it on a vulnerable iPhone, and it tries to break in before you fill out the form.ResearchVulnerability Apple patches CoreGraphics zero-day flaw exploited in attackshttps://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/1llq9udTue, 29 Sep 2026 07:33:12 GMTBleepingComputer (+6 more sources). Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]AdvisoryVulnerabilityZero-day APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1https://seclists.org/fulldisclosure/2026/Sep/91cq7kfTue, 29 Sep 2026 06:08:32 GMTFull Disclosure. Posted by Apple Product Security via Fulldisclosure on Sep 28 APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1 macOS Sequoia 15.8.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/149229 . Apple…Advisory APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1https://seclists.org/fulldisclosure/2026/Sep/902qlvgTue, 29 Sep 2026 06:08:31 GMTFull Disclosure. Posted by Apple Product Security via Fulldisclosure on Sep 28 APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1 macOS Tahoe 26.7.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/149228 . Apple…Advisory APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1https://seclists.org/fulldisclosure/2026/Sep/893oole2Tue, 29 Sep 2026 06:08:30 GMTFull Disclosure. Posted by Apple Product Security via Fulldisclosure on Sep 28 APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1 iOS 26.7.1 and iPadOS 26.7.1 addresses the following issues. Information about the security content is also available at…Advisory Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)https://isc.sans.edu/diary/rss/333761lbkt5jMon, 28 Sep 2026 22:35:35 GMTSANS ISC. Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected.…AdvisoryVulnerabilityZero-day iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and laterhttps://support.apple.com/en-us/149226129dea3Mon, 28 Sep 2026 07:00:00 GMTApple Security Updates. Advisory macOS Tahoehttps://support.apple.com/en-us/14922811pe6w5Mon, 28 Sep 2026 07:00:00 GMTApple Security Updates. Advisory macOS Sequoiahttps://support.apple.com/en-us/14922911fel76Mon, 28 Sep 2026 07:00:00 GMTApple Security Updates. Advisory Decades-old file security flaws found in Android, Linux, macOS, and Windowshttps://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/52986721d2yftThu, 24 Sep 2026 17:00:00 GMTThe Register. Security researchers report that Microsoft considers the side-channel leak of file events to be by designVulnerability A new version of the MacSync macOS stealer targets crypto enthusiasts and developershttps://news.google.com/rss/articles/CBMiX0FVX3lxTE8yWjY4V0ZnNmRHY0dNdk51Y3lqcmV6N1JjR0RMRWRtc2Z6aXpEWTZVZW5rcGRkeHF4OW9JWERkRlFSUl9QWEpYMmhQem50WlltUEhJRmFnQWhkdW1JcE5z?oc=51kla8jrThu, 24 Sep 2026 07:00:00 GMTSecurelist (Kaspersky). A new version of the MacSync macOS stealer targets crypto enthusiasts and developers SecurelistResearchMalware One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Promptshttps://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html134m9vaWed, 23 Sep 2026 21:59:34 GMT0dayfans. # One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Prompts 24 Sep 2026 - Posted by Leonardo Giovannini ## TL;DR While testing deep links in Chrome for iOS, we noticed a small but important difference. Opening a third-party app through a custom…AdvisoryVulnerability British regulator takes a hard look at Pornhub's Apple-powered age checkshttps://www.theregister.com/security/2026/09/23/british-regulator-takes-a-hard-look-at-pornhubs-apple-powered-age-checks/5298558ncie2mWed, 23 Sep 2026 11:53:37 GMTThe Register. Regulator wants to know whether parent Aylo did its homework before reopening the door to UK iPhone usersLaw & policy Apple macOS CoreWLAN information disclosure vulnerabilityhttps://talosintelligence.com/vulnerability_reports/TALOS-2026-23761z0ppfzWed, 23 Sep 2026 00:00:07 GMT0dayfans. TALOS-2026-2376 A information disclosure vulnerability exists in the CoreWLAN functionality of macOS (version(s): 26.3.1(25D2128)). A specially crafted API call can lead to information disclosure. An attacker can call a sequence of APIs to trigger this…AdvisoryVulnerability