#iOS
All CosmicBytez Labs articles tagged #iOS, across news, security advisories, how-to guides, and projects.
- News
P7 DarkSword: New iOS Exploit Kit Variant Adds Crypto Wallet Theft and Remote Commands
A stealthier DarkSword variant called P7 extracts crypto wallet keys and keychain data locally before exfiltration, and polls for live commands.
- News
Apple Patches Meta-Reported Zero-Day Tied to 'Extremely Sophisticated' Attack
Apple fixed CVE-2026-86950, a CoreGraphics flaw reported by Meta and used against targeted individuals, via iOS, iPadOS, and macOS updates.
- Security
CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution
An out-of-bounds write in Apple CoreGraphics lets a malicious file trigger code execution on iOS, iPadOS, and macOS; CVSS 8.8, patched September 28.
- News
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins
Meta announces WhatsApp support for multiple passkeys per account on iOS and Android, ending password reliance with phishing-resistant biometric auth.
- News
Apple Sends New Threat Notification Alerts Over Mercenary Spyware Attacks
Apple warned iPhone users in 110 countries of mercenary spyware attacks. Enable Lockdown Mode and update iOS immediately if you receive an alert.
- Security
CVE-2026-66061: Home Assistant iOS App NFC Tag Spoofing via Universal Links
The Home Assistant iOS Companion app prior to 2026.5.0 fails to validate whether NFC or QR tag links arrive via physical scan or iOS universal link,...
- Security
CVE-2026-28928: Apple Platform Use-After-Free Causes Unexpected System Termination
A critical use-after-free vulnerability affects iOS, iPadOS, macOS, tvOS, and watchOS. A malicious app can trigger unexpected system termination. Apple...
- Security
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco IOS 12.4 contains multiple CSRF vulnerabilities that allow remote attackers to execute arbitrary commands. The flaw has been added to the CISA Known...
- Security
CVE-2026-28872: Apple iOS & iPadOS Remote Denial-of-Service
A CVSS 7.5 denial-of-service vulnerability in Apple iOS and iPadOS allows a remote attacker to exhaust device resources and crash the operating system...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
Apple Expands iOS 18 Updates to More iPhones to Block
Apple has extended security update eligibility to additional iPhone models still running iOS 18, enabling more devices to receive protections against the...
- News
TA446 Deploys DarkSword iOS Exploit Kit in Targeted
Proofpoint has attributed a targeted email campaign to Russian state-sponsored threat actor TA446, which is leveraging the recently disclosed DarkSword...
- Newsletter
Mar 27 Digest: EU Commission AWS Breach, DarkSword iOS
The European Commission confirms a 350 GB AWS breach; the DarkSword iOS exploit chain goes public on GitHub threatening hundreds of millions of iPhones;...
- News
DarkSword GitHub Leak Threatens to Turn Elite iPhone
Researchers say the GitHub leak of the DarkSword iOS exploit chain — six chained vulnerabilities targeting iOS 18.4 through 18.7 — threatens to...
- Newsletter
Mar 25 Digest: DarkSword Leaks iPhone Zero-Days
This week: the DarkSword iOS exploit chain published on GitHub threatens to democratize nation-state-grade iPhone hacking; CanisterWorm turns the Trivy...
- News
CISA Adds Apple DarkSword iOS Exploits, Craft CMS, and Laravel Livewire Flaws to KEV Catalog
CISA orders federal agencies to patch five actively exploited vulnerabilities by April 3, including three Apple flaws linked to the DarkSword iOS exploit...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...
- News
ZeroDayRAT Mobile Spyware Enables Total Surveillance of iOS
A new mobile spyware platform called ZeroDayRAT supports Android 5-16 and iOS up to version 26, providing real-time camera streaming, keylogging, 2FA...
- Security
Apple Patches Actively Exploited iOS Zero-Day Used in Targeted Attacks
Apple has patched CVE-2026-20700, a memory corruption vulnerability in dyld used in 'extremely sophisticated' targeted attacks. Discovered by Google TAG,...
- Security
Apple Patches Actively Exploited Zero-Day in dyld
Apple releases emergency patches across all platforms for a memory corruption vulnerability in the Dynamic Link Editor (dyld) that was exploited in...
- News
Apple Releases Critical Security Updates Across All
Apple has released security updates for iOS, macOS, watchOS, and tvOS addressing multiple actively exploited vulnerabilities. Users urged to update immediately.