Executive Summary Following disclosure of the TraderTraitor attack against LayerZero in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a victim in the IT services sector with no relationship to cryptocurrency trading. We also identified more weaponized GitHub repositories from the social engineering schemes used to target job seekers in these campaigns. This report…
Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since…
Serial Number: AV26-930Date: September 16, 2026 As of September 14, 2026, Apple is affected by vulnerabilities in the following products: iOS and iPadOS Prior to 27 Prior to 26.7 macOS Golden Gate Prior to 27 macOS Tahoe Prior to 26.7 macOS Sequoia Prior to 15.8 tvOS Prior to 27 watchOS Prior to 27 visionOS 27 Prior to 27 Safari Prior to 27 Xcode Prior to 27 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become…
Apple ha rilasciato aggiornamenti di sicurezza per risolvere 273 nuove vulnerabilità nei prodotti iOS, iPadOS, macOS Golden Gate, macOS Tahoe, macOS Sequoia, tvOS, watchOS, visionOS, Safari e Xcode.
Apple heeft meerdere kwetsbaarheden verholpen in macOS (Specifiek voor Golden Gate 27, Sequoia 15.8, Tahoe 26.7). De kwetsbaarheden in macOS betreffen onder andere heap-based buffer overflows, use-after-free fouten, integer overflows, null pointer dereferences, onjuiste toegangscontrole, privilege escalatie, race conditions, out-of-bounds reads en writes, loggingsproblemen, en problemen met state management. Deze kunnen leiden tot onverwachte systeem- of applicatie-terminaties, kernel geheugen…
Apple heeft meerdere kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals authenticatiefouten, out-of-bounds schrijf- en leesfouten, use-after-free, buffer overflows, race conditions, permissie- en autorisatieproblemen, geheugenbeschadiging, informatielekken, logica- en validatiefouten, en privacy-gerelateerde zwakheden. Aanvallers kunnen deze kwetsbaarheden misbruiken om ongeautoriseerde toegang te verkrijgen tot gebruikersgegevens,…
I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took a quick look at macOS 27 "Golden Gate" to see what traffic you should expect. Here are some of the highlights: I captured about 300 packets. This was likely inflated for this particular system as it connected via Wi-Fi and wired network interfaces. Each network interface will do its own DHCP/IP discovery during boot. I only used router advertisements for IPv6, not…
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases. In addition to the major "27" version, Apple also released bug-fix-only releases for the 26 branch of its operating systems and for 15 (Sequioa) for macOS. None of the vulnerabilities is…
First, the good news: If you use a Linux-based operating system, you may not be asked your age in a few months. The bad news is that Windows, macOS, iOS, and Android users in California will be. California has passed a law that requires a range of operating systems to start collecting your age when you first set them up. Under the state’s Digital Age Assurance Act (DAAA), signed into law in October 2025, Windows, macOS, iOS, and Android will all have to do this from January 1, 2027. Operating…
Scammers are becoming more strategic about where they target people. Nine in ten toll scams—the fake unpaid-toll messages that threaten fines or license suspension—arrive by email or text, while roughly six in ten romance scams show up first on social media. That’s no coincidence. Rather than blasting the same message everywhere, criminals are tailoring different scams to the platforms where they’re most likely to succeed. This finding comes from Malwarebytes’ own threat research systems and…
Uživatelé iPhonů se stávají terčem nového podvodu vydávajícího se za technickou podporu, který se je snaží oklamat pomocí falešného upozornění na platbu přes Apple Pay. Na podvodné webové stránce se zobrazí upozornění, které věrohodně napodobuje systémovou notifikaci telefonu a průběh platby přes Apple Pay, včetně údajného ověřování pomocí Face ID a dalších běžných bezpečnostních prvků. Následuje varování o zablokování Apple ID a výzva ke kontaktování falešné podpory Apple. Stránka navíc dokáže…
iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users. Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones. Instead of a desktop warning claiming your computer has a virus, the scam imitates familiar iPhone features including Apple Pay, Face ID, and App Store payments. It even uses the phone’s own text-to-speech…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-43798, CVE-2026-43670, CVE-2026-65367, CVE-2026-64705, CVE-2026-43657, Summary: CVE-2026-43798 9.8 A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1. CVE-2026-43670 8.8 A Content…
A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. [...]
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-64715.
Serial Number: AV26-839Date: August 21, 2026 As of August 18, 2026, Apple is affected by vulnerabilities in the following products: Safari Prior to 26.6.1 iOS and iPadOS Prior to 18.7.10 Prior to 26.6.1 MacOS Tahoe Prior to 26.6.2 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Apple security releases - Apple Support
Welcome to this week’s edition of the Threat Source newsletter. Hello friend. I’m Mick. This is my first Threat Source newsletter, so I should probably introduce myself before I start telling you all the things I think you should be paying attention to. With assistance from an unnamed LLM, my bio reads like this: Mick Baccio is a globally recognized security strategist with a career spanning offensive operations, threat intelligence, and national-level incident response. He currently advises…
Your Mac comes with a built-in firewall, but it’s probably not something you’ve given much thought to. A firewall helps control incoming connections—requests from apps and other devices that want to connect to your Mac—giving you an extra layer of protection whenever you’re online. For most people, the default settings work just fine. But if you ever want more control over how your firewall works, whether you’re on public Wi-Fi or want to adjust which apps can connect, those settings aren’t…
Aggiornamenti di sicurezza Apple sanano molteplici vulnerabilità, di cui una con gravità "alta", in Safari. Tale vulnerabilità, qualora sfruttata, potrebbe compromettere la disponibilità del servizioe e, in talune condizioni, consentire l'esecuzione di codice arbitrario remoto sui sistemi interessati.
Apple heeft meerdere kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen onder andere onjuist geheugenbeheer zoals use-after-free, buffer overflows, out-of-bounds reads en writes, integer overflows, race conditions, en onvoldoende inputvalidatie. Deze fouten kunnen leiden tot onverwachte crashes, geheugenbeschadiging, het lekken van gevoelige gegevens zoals OAuth2 tokens en kernel geheugen, het omzeilen van sandboxbeperkingen, en in sommige gevallen het uitvoeren van…
Apple heeft kwetsbaarheden verholpen in macOS Tahoe 26.6.2 De kwetsbaarheden betreffen meerdere aspecten van geheugenbeheer, inputvalidatie en state management binnen Apple’s besturingssystemen en Safari-browser. Een aantal kwetsbaarheden maakt het mogelijk dat een kwaadwillende door het verwerken van speciaal vervaardigde webcontent of afbeeldingen geheugenbeschadiging veroorzaakt, wat kan leiden tot onverwachte crashes, systeemterminatie of het lekken van gevoelige gebruikersinformatie.…
Serial number: AV26-823Date: August 17, 2026Updated: August 18, 2026 As of August 6, 2026, Apple is affected by vulnerabilities in the following products: macOS Tahoe Prior to 26.6.1 macOS Sequoia Prior to 15.7.9 macOS Sonoma Prior to 14.8.9 Open-source reporting indicates that CVE-2026-65400 is being exploited in the wild. Update 1 On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-65400 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber…
In this article Activity overview Discovery of additional rotating infrastructure Attack chain overviewMitigation and protection guidanceReferencesLearn more MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure…
Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and macOS Tahoe,including yet another image parsing vulnerability that could compromise your device. This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. Updates for your particular device The table below shows which updates are available and points you to the relevant security content for each one. Name and information linkAvailable foriOS…
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-65400 Apple macOS Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector…
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS. None of the vulnerabilities has been exploited so far. There are a few WebKit vulnerabilities, but no standalone Safari patch for older operating systems. 87 of the vulnerabilities affect only iOS 18, making this more of an iOS…
About 20 years ago, with macOS 10.5 (Leopard), Apple introduced screen sharing. Apple did not invent a new protocol for screen sharing. Instead, it used the established VNC protocol. VNC is a pretty simple, unencrypted protocol using TCP port 5900. Historically, the protocol used a simple global password for authentication. Apple adapted the protocol for its own use, but overall, left the VNC protocol itself alone. A couple of weeks ago, two severe vulnerabilities exposed issues Apple…
For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were encrypted but stated that no data theft was detected during the incident. MyDr, Poland’s primary…
Last week on Malwarebytes Labs: Apple now uses iPhone alerts for targets of mercenary spyware WhatsApp is testing a new warning for scam messages New Android malware lets criminals use your bank card in real time Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits “Zoomsday” flaws could let one Zoom participant attack another Patch Tuesday: Update now to fix 421 flaws, including three zero-days Fake CCleaner installs GhostDesk Chrome spyware Valve warns Steam hardware…
Apple has expanded its threat-notification system for targets of mercenary spyware. Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page. In the explanation, Apple states: “Apple threat notifications are high-confidence alerts that a user…
Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live.…
Coding agents such as Claude Code and Cursor are vendor-signed, used all day on developer laptops, and routinely open shells, call APIs, edit files, and install helpers. That makes GenAI-adjacent alerts challenging to investigate. The parent looks trusted, while the children can still look a lot like classic high-severity activity. This article walks through one of those windows. On a macOS endpoint, Elastic Security endpoint telemetry showed shells under Claude Code that scripted a login to an…
Apple’s latest macOS update addresses two vulnerabilities in its Screen Sharing server, including one that enables pre-authenticated remote code execution.
Coding agents such as Claude Code and Cursor are vendor-signed, used all day on developer laptops, and routinely open shells, call APIs, edit files, and install helpers. That makes GenAI-adjacent alerts challenging to investigate. The parent looks trusted, while the children can still look a lot like classic high-severity activity. This article walks through one of those windows. On a macOS endpoint, Elastic Security endpoint telemetry showed shells under Claude Code that scripted a login to an…
In this article Activity overviewHow ClickFix works Campaign overviewClickFix moved from open pages to fingerprinting gatesThe fingerprinting gateMitigation and protection guidanceIndicators of compromise (IOC)ReferencesLearn more Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. The campaign evolved from broadly serving ClickFix lures to using a server-side…
Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump.For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information,…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-43673.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the ImageIO library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-43780.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-43733.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-43729.
If you just want to read the rules, you can find them here. Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event…
Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:…
We’re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. For June 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web…
Objevila se nová forma phishingového útoku, která zneužívá legitimní aplikace pro sledování objednávek k zobrazování falešných účtenek za údajné nákupy nebo předplatná. Aktuálně jsou takové útoky hlášeny především v aplikaci Shop od společnosti Shopify, nelze však vyloučit využití této techniky i v dalších aplikacích pro sledování objednávek. Namísto tradičních phishingových e-mailů se podvodné zprávy zobrazují přímo v prostředí aplikace, kde uživatelé běžně sledují své skutečné objednávky, což…
Day Two of Pwn2Own Berlin 2026 and the stakes continue to rise! Security researchers are back on the Pwn2Own stage, pushing enterprise systems to their limits as the competition heats up. More exploits, more surprises, and more standout moments are unfolding, so follow along here for live updates as the race for Master of Pwn intensifies. There were plenty of big targets on the schedule today, including SharePoint, Exchange, and Safari.Following an action-packed Day One where $523,000 was…
When a company suffers a cyber breach, its stock price often takes a hit, but the timing, depth, and duration of that reaction are far less predictable. In this LABScon25 presentation, Mick Baccio and Scott Roberts explore whether public indicators of breach activity can be used to anticipate market response before formal disclosure. Drawing on sources such as EDGAR filings, executive blog posts, and social media chatter, the speakers examine how public breadcrumbs can reveal incident activity…
We’ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn’t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. For May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn’t provide CVSS scores or other…