#Apple
All CosmicBytez Labs articles tagged #Apple, across news, security advisories, how-to guides, and projects.
- News
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Delivery Path
Researchers released a PoC for CVE-2026-86950, a CoreGraphics bug Apple patched after targeted attacks; WhatsApp's new PDF scans hint at the delivery path.
- News
Google Gemini Could Soon Get Full Access to Your Mac's Files, Apps, and the Web
A hidden setting in Gemini's macOS app could let the AI read, edit, and delete any file, control native apps, and browse the web without asking first.
- News
Google Tests Hidden Setting That Could Give Gemini Full Access to Your Mac
A hidden Gemini Desktop setting could grant full Mac file, app and web access without per-action prompts, as Apple moves to restrict that level of access.
- News
Apple Patches Meta-Reported Zero-Day Tied to 'Extremely Sophisticated' Attack
Apple fixed CVE-2026-86950, a CoreGraphics flaw reported by Meta and used against targeted individuals, via iOS, iPadOS, and macOS updates.
- News
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Apple confirms CVE-2026-86950 was used in a sophisticated spyware-style attack on specific targets; CISA set an Oct. 2 deadline for agencies.
- Security
CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution
An out-of-bounds write in Apple CoreGraphics lets a malicious file trigger code execution on iOS, iPadOS, and macOS; CVSS 8.8, patched September 28.
- Newsletter
Weekly Digest — Issue #37
Dual Citrix NetScaler zero-days spark global chaos, Apple patches a Meta-reported spyware bug, and an agentic AI attacker wipes an Azure tenant in 7 minutes.
- News
Apple Sends New Threat Notification Alerts Over Mercenary Spyware Attacks
Apple warned iPhone users in 110 countries of mercenary spyware attacks. Enable Lockdown Mode and update iOS immediately if you receive an alert.
- News
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
This week's security roundup: Apple caps bug bounty submissions as AI-generated reports surge, NC ports hit by cyberattack, hedge funds targeted by...
- Security
CVE-2026-8457: WooCommerce Social Login Authentication Bypass (CVSS 9.8)
A critical authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin allows unauthenticated attackers to log in as any...
- News
Apple Sued Over Fake App Store Crypto Wallet That Stole $1.8M in Bitcoin
Three plaintiffs have filed suit against Apple in California federal court after a fraudulent Sparrow Wallet impersonator on the App Store harvested their...
- Security
CVE-2026-28911: macOS Critical Memory Corruption via Malicious App
A critical memory corruption vulnerability in macOS allows a malicious application to corrupt memory of a system process. Apple patched the flaw in macOS...
- Security
CVE-2026-28928: Apple Platform Use-After-Free Causes Unexpected System Termination
A critical use-after-free vulnerability affects iOS, iPadOS, macOS, tvOS, and watchOS. A malicious app can trigger unexpected system termination. Apple...
- Security
CVE-2026-28982: macOS Race Condition Allows Remote Kernel Memory Corruption
A critical race condition in macOS enables a remote attacker to cause unexpected system termination or corrupt kernel memory. Apple patched the flaw in...
- News
PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
Jamf Threat Labs has discovered PamStealer, a sophisticated two-stage macOS infostealer that impersonates the Maccy clipboard manager, delivers a...
- News
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week's security roundup covers AI compute theft, a newly discovered Apple Mail vulnerability, the emerging BlueHammer ransomware group, and 14...
- News
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs
Qihoo 360 unveils Tulongfeng — a Chinese rival to Anthropic's Mythos AI vulnerability finder; the World Leaks ransomware group dumps 630 GB from Tata...
- News
Tata Electronics Confirms Cyberattack; World Leaks Exposes Apple Manufacturing IP
World Leaks — the rebranded extortion wing of the defunct Hunters International ransomware group — has leaked Apple manufacturing data stolen from Tata...
- News
New Exploit Bypasses Apple's Boot Defenses, Affects Millions of iPhones
The Usbliter8 exploit targets a hardware-level flaw in Apple A12 and A13 SecureROM boot chains that cannot be patched via software updates, leaving...
- News
In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum
This week's security roundup covers Apple's patch for a Beats headphones eavesdropping vulnerability, the DOT closing its investigation into Delta's...
- News
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
Security researchers at Paradigm Shift have published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of...
- News
Apple Open-Sources Quantum-Resistant Encryption Code
Apple has open-sourced its implementations of two NIST-standardized quantum-secure algorithms — ML-KEM and ML-DSA — including formal verification tooling that.
- News
Apple Blocked Over $11 Billion in App Store Fraud in 6 Years
Apple has revealed it blocked more than $11 billion in fraudulent App Store transactions over the past six years, including $2.2 billion in 2025 alone,...
- News
Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention
Apple's annual transparency report reveals the company blocked over 2 million App Store submissions, 1.1 billion accounts, and $2.2 billion in potentially...
- Security
CVE-2026-28872: Apple iOS & iPadOS Remote Denial-of-Service
A CVSS 7.5 denial-of-service vulnerability in Apple iOS and iPadOS allows a remote attacker to exhaust device resources and crash the operating system...
- News
Apple Account Change Alerts Abused to Send Phishing Emails
Threat actors are exploiting Apple's legitimate account change notification system to embed fake iPhone purchase scams inside genuine Apple emails,...
- Security
CVE-2026-28815: swift-crypto X-Wing HPKE Out-of-Bounds Read
A crafted short X-Wing HPKE encapsulated key can trigger an out-of-bounds read in the C decapsulation path of Apple's swift-crypto library, potentially...
- News
Apple Expands iOS 18 Updates to More iPhones to Block
Apple has extended security update eligibility to additional iPhone models still running iOS 18, enabling more devices to receive protections against the...
- News
Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple
This week's cybersecurity roundup covers long-running telecom espionage operations reaching courtrooms, resurging LLM jailbreak techniques, Apple's UK age...
- News
CISA Adds Apple DarkSword iOS Exploits, Craft CMS, and Laravel Livewire Flaws to KEV Catalog
CISA orders federal agencies to patch five actively exploited vulnerabilities by April 3, including three Apple flaws linked to the DarkSword iOS exploit...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...
- Security
Apple Patches Actively Exploited iOS Zero-Day Used in Targeted Attacks
Apple has patched CVE-2026-20700, a memory corruption vulnerability in dyld used in 'extremely sophisticated' targeted attacks. Discovered by Google TAG,...
- Security
Apple Patches Actively Exploited Zero-Day in dyld
Apple releases emergency patches across all platforms for a memory corruption vulnerability in the Dynamic Link Editor (dyld) that was exploited in...
- News
Apple Releases Critical Security Updates Across All
Apple has released security updates for iOS, macOS, watchOS, and tvOS addressing multiple actively exploited vulnerabilities. Users urged to update immediately.