10 ms·
Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware
- cpncrunch 9mo agoNo updates for ipados17. I guess my ipad pro 10.5 is finally a brick.
- cmurf 9mo agoFeudalism says: buy new hardware, peasant. I don't know what "equally annoying" would be for a company and its customers, i.e. a fair compromise. But we need a law requiring companies open source their hardware within X days of end of life support. And somehow make sure these are meaningful updates. Not feature parity with new hardware, but security parity when it can be provided by a software only update. Otherwise a company in effect takes back the property, without compensation.
- cpncrunch 9mo agoThe battery has very little capacity now, so I'm planning on buying a new iPad air with the M chip. It's really a game changer in terms of performance and efficiency.
- brainzap 9mo agoI am shocked to hear that over these years it was possibl to extract data from a locked iphone. (hardening mode off) I trusted apple.
- gruez 9mo ago>I trusted apple. To what? Write 100% bug free software? I don't think that's actually achievable, and expecting so is just setting yourself up for appointment. Apple does a better job than most other vendors except maybe GrapheneOS. Mainstream Android vendors are far worse. Here's Cellebrite Premium's support matrix from July 2024, for locked devices. iPhones are vulnerable after first unlock (AFU), but Androids are even worse. They can be hacked even if they have been shut down/rebooted. https://grapheneos.social/system/media_attachments/files/112/826/066/256/335/333/original/176bc82f0c5204a8.png https://grapheneos.social/system/media_attachments/files/112... https://grapheneos.social/system/media_attachments/files/112/826/163/595/741/238/original/ffd1f438a564e7ac.png https://grapheneos.social/system/media_attachments/files/112... https://grapheneos.social/system/media_attachments/files/112/826/164/084/167/269/original/7135f327f0cdbb67.png https://grapheneos.social/system/media_attachments/files/112...
- fsflover 9mo agoQubes OS does a much better job though, because it relies on security through compartmentalization, not security through correctness.
- gruez 9mo agoThe problem with that is it runs on a desktop, which means very little in the way of protection against physical attacks. You might be safe from Mossad trying to hack you from half way across the world, but you're not safe from someone doing an evil maid attack, or from seizing it and bruteforcing the FDE password (assuming you didn't set a 20 random character password).
- fsflover 9mo agoTPM with Heads protects my laptop from such attacks just fine. All based on FLOSS. > assuming you didn't set a 20 random character password It doesn't have to be all random characters for good protection.
- user205738 9mo agoIf someone puts passwords shorter than 30 characters on their devices, then everything that happens to them is their own fault.
- RankingMember 9mo agoThese links working for anyone? 403 for me
- gruez 9mo agoUpdated the links. The original were from discuss.grapheneos.org but it looks like they don't like hot-linking.
- CharlesW 9mo agoThis is a newly-discovered vulnerability (CVE-2026-20700, addressed along with CVE-2025-14174 and CVE-2025-43529). Note that the description "an attacker with memory write capability may be able to execute arbitrary code" implies that this CVE is a step in a complex exploit chain. In other words, it's not a "grab a locked iPhone and bypass the passcode" vulnerability.
- jrmg 9mo agoI may well be missing something, but this reads to me as code execution on user action, not lock bypass. Like, you couldn’t get a locked phone that hadn’t already been compromised to do anything because it would be locked so you’d have no way to run the code that triggers the compromise. Am I not interpreting things correctly? [edit: ah, I guess “An attacker with memory write capability” might cover attackers with physical access to the device and external hardware attached to its circuit board that can write to the memory directly?]
- saagarjha 9mo agoNo your original analysis is fine
- j16sdiz 9mo agoWhat does "zero-day" even meant? > ... decade-old ... > ... was exploited in the wild ... > ... may have been part of an exploit chain....
- runjake 9mo ago“Zero day” has meant different things over the years, but for the last couple-ish decades it’s meant “the number of days that the vendor has had to fix them” AKA “newly-known”.
- EvanAnderson 9mo agoIt still weirds me out that a term w@r3z d00dz from the 90s coined is now a part of the mainstream IT security lexicon.
- sejje 9mo agoConsider that there's probably a large overlap between those groups
- EvanAnderson 9mo agoOld-timers, at this point, but I take your point. I guess, for that matter, the terms "social engineering" (as it relates to manipulating people into divulging secrets, etc) and "doxxing" both came from the same community, too. How bizarre. Terms that were bandied about by kids in text files became actual industry jargon (and, in the case of "doxxing", arguably mainstream).
- runjake 9mo agoRight, I think the use of "0-day" as "stolen, unreleased software by software pirates" predates the current use. The other commenter is right, there's a lot of overlap in the communities. It's strange to me that I was in the "field" a good 20 years before I ever thought it would be a career opportunity. This is not a complaint by any means. :-)
- 9mo ago
- zero0529 9mo agoI guess the fix is only for Tahoe? Edit: I meant iOS 18
- bzzzt 9mo agoThere's an update for Sequoia too.
- cluckindan 9mo agoBut not for iOS 18, so this is a forced upgrade to the horrors of Liquid Glass. Can’t wait to see how much battery it eats.
- MYEUHD 9mo agoThe zero-day mentioned in the article doesn't affect macOS. But there were security updates for macOS 14 and macOS 15 released yesterday: https://support.apple.com/en-us/126350 https://support.apple.com/en-us/126350 https://support.apple.com/en-us/126349 https://support.apple.com/en-us/126349
- asah 9mo agoOpen source wins... again.
- saagarjha 9mo agoUnfortunately it doesn’t actually
- baq 9mo agoas in I now have to upgrade all my children's ancient iphones...? I'd much rather not do that
- kstrauser 9mo agoYou’d rather they not release updates to support them?
- baq 9mo agoI'd rather they did so I don't have to upgrade edit: my original post wasn't clear I see - I meant I don't want to ditch the phones they've got and hope Apple releases an update for ios 16
- kstrauser 9mo agoOhhhh, I see what you mean now. I read that as you didn't want to upgrade the software, but you meant you didn't want to replace the hardware. Yeah, that makes sense. I hope you get an update for them, too.
- alt227 9mo agoWhy cant they just release security patches for older versions of iOS instead of forcing to upgrade version?
- lagadu 9mo agoThe exploit was always there, you just didn't know about it, but attackers might have. The only thing that changed is that you're now aware that there's a vulnerability.
- samtheprogram 9mo agoAnd now everyone else is aware of it too... including anyone marginally above a scriptkiddie.
- max_ 9mo agoMy suspicion is that. These "exploits" are planted by spy agencies. They don't appear there organically.
- bell-cot 9mo agoMaybe sometimes? With how many bugs are normally found in very complex code, would a rational spy agency spend the money to add a few more? Doing so is its own type of black op, with plenty of ways to go wrong. OTOH, how rational are spy agencies about such things?
- max_ 9mo agoYes. Of course not all. But some just happen to work too well. But governments do have blatant back doors in chips & software.
- 2OEH8eoCRo0 9mo agoSome suspect that Apple secretly backs some of these spyware services. I've heard rumors about graykey but only rumors. Thoughts?
- gruez 9mo ago>Some suspect ... >I've heard rumors ... So like, the comment you're replying to? This is just going in circles.
- zappb 9mo agoThis vastly overstates both the competence of spy agencies and of software engineers in general. When it comes to memory unsafe code, the potential for exploits is nearly infinite.
- xnx 9mo ago> overstates both the competence of spy agencies Stuxnet was pretty impressive: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- meisel 9mo agoI wonder what the internal conversations are like around memory safety at Apple right now. Do people feel comfortable enough with Swift's performance to replace key things like dyld and the OS? Are there specific asks in place for that to happen? Is Rust on the table? Or does C and C++ continue to dominate in these spaces?
- gsnedders 9mo agoWhile not wholesale replacing it, there already is Swift in dyld: https://github.com/search?q=repo%3Aapple-oss-distributions%2Fdyld++language%3ASwift&type=code https://github.com/search?q=repo%3Aapple-oss-distributions%2...
- saagarjha 9mo agoThis goes into dyld.framework, not dyld the linker
- ronsor 9mo agoApple is already working on a memory-safe C variant which is already used in iBoot and will be upstream LLVM soon: https://clang.llvm.org/docs/BoundsSafety.html https://clang.llvm.org/docs/BoundsSafety.html
- greenie_beans 9mo ago[flagged]
- ChrisArchitect 9mo agoPreviously: https://news.ycombinator.com/item?id=46979643 https://news.ycombinator.com/item?id=46979643
- erichocean 9mo agoI wonder if Fil-C would have prevented this.
- bigyabai 9mo agoDoubtful, Apple is one of the largest advocates of safe C already.
- dudeinhawaii 9mo agoSo the exploiters have deprecated that version of spyware and moved on I see. This has been the case every other time. The state actors realize that there's too many fingers in the pie (every other nation has caught on), the exploit is leaked and patched. Meanwhile, all actors have moved on to something even better. Remember when Apple touted the security platform all-up and a short-time later we learned that an adversary could SMS you and pwn your phone without so much as a link to be clicked. KSIMET: 2020, FORCEDENTRY: 2021, PWNYOURHOME, FINDMYPWN: 2022, BLASTPASS: 2023 Each time NSO had the next chain ready prior to patch. I recall working at a lab a decade ago where we were touting full end-to-end exploit chain on the same day that the target product was announcing full end-to-end encryption -- that we could bypass with a click. It's worth doing (Apple patching) but a reminder that you are never safe from a determined adversary.
- mmmlinux 9mo agoThanks for contributing to our increasing lack of security and anonymity.
- avazhi 9mo agoMeh. It’s up to Apple to write secure software in the first place. Maybe if they spent more time on that instead of fucking over their UI in the name of something different, and less time virtue signalling, their shit would be more secure.
- x0x0 9mo agoI totally agree, and it's basically theft that Apple simply doesn't have a standing offer to outbid anyone else for a security hole. That said, we all get the same time on this earth. Spending your time helping various governments hurt or kill people fighting for democracy or similar is... a choice.
- avazhi 9mo agoI don't think democracy is the panacea you seem to think it is, but that's another issue. Certainly, cracking software for governments and the police is no less legitimate an existence and occupation as, say, working for an NGO.
- walterbell 9mo agoDid MIE/MTE on 2025 iPhones help to detect this longstanding zero day?
- shantara 9mo agoMeanwhile Apple made a choice to leave iOS 18 vulnerable on the devices that receive updates to iOS 26. If you want security, be ready to sacrifice UI usability.
- argsnd 9mo agoIf you set Liquid Glass to the more opaque mode in settings I find iOS usability to be fine now, and some non-flashy changes such as moving search bars to the bottom are good UX improvements. The real stinker with Liquid Glass has been macOS. You get a half-baked version of the design that barely even looks good and hurts usability.
- microtonal 9mo agoStill takes multiple taps to find something on a page in Safari.
- bobbylarrybobby 9mo agoYou can just type the text to find in the address bar — “find on page” will be the at the very bottom of the list of suggestions.
- ndiddy 9mo agoYou can restore the old UI by changing the “tabs” setting from “compact” to “top” or “bottom”.
- argsnd 9mo agoThis is, again, something you can fix in Settings
- JensenTorp 9mo agoiOS 26 is a disaster on devices with 4GB RAM though, so I'm not upgrading my iPhone 13 Mini again (that was a traumatic few days).
- 9mo ago
- the_harpia_io 9mo ago[flagged]
- walterbell 9mo ago> the bigger issue is detection Apple could do more for device security forensics. Meanwhile, user app activity goes into "biome" files for theft by malware, https://bluecrewforensics.com/2022/03/07/ios-app-intents/ https://bluecrewforensics.com/2022/03/07/ios-app-intents/
- the_harpia_io 9mo ago[flagged]
- saagarjha 9mo agoI’m pretty sure the dyld code involved was written in the last 5 years if not more recently than that
- the_harpia_io 8mo ago[flagged]
- saagarjha 8mo agoAFAIK dyld3 and dyld4 are kind of the same codebase, it’s dyld2 that got nuked. It’s definitely new code though
- deleted 8mo ago[deleted]
- the_harpia_io 8mo ago[flagged]
- 8mo ago
- prodigycorp 9mo agoWhat's never mentioned in posts like this is whether phones in lockdown mode were vulnerable too.
- jl6 9mo agoOh great, so is this how Apple forces me to downgrade from iOS 18 to iOS 26?
- Towaway69 9mo agoThat was my first thought. No backports for older devices? So left to update to 26.3, device slows, battery life deteriorates and a new device needs to be ~~purchased~~ … errr rented. Good that apple has a monopole else consumers would have a choice.
- fsflover 9mo agoThere is a choice. Sent from my GNU/Linux phone Librem 5.
- Towaway69 9mo agoThat does universal copy and paste with my linux laptop? Airdrop with my android tablet? I can copy something on my macbook and paste that on my iphone - nice feature. Or to my iPad. I’m a sucker for interconnected technology, no hassle with transferring data between my devices. Sure there are alternatives, but none that provide such integration amongst diverse class of devices. That’s the true monopole they have - unfortunately.
- armadyl 9mo ago> That does universal copy and paste with my linux laptop? Airdrop with my android tablet? To be fair this can be replicated with LocalSend, albeit not as slick UX wise.
- dundundundun 9mo agoThat's a tradeoff you make yourself and in no way a monopoly.
- fsflover 9mo ago> That does universal copy and paste with my linux laptop? Airdrop with my android tablet? I didn't try, but yes: https://linuxphoneapps.org/services/kde-connect/ https://linuxphoneapps.org/services/kde-connect/
- j45 9mo agoIt's pretty unbeliveable that a zero-day can sit here this long. If one can exist, the likeliehood of more existing at all times is non-trivial. Whether it's a walled garden of iOS, or relative openneds of Android, I don't think either can police everythign on anyone's behalf. I'm not sure how organizations can secure any device ios or android if they can't track and control the network layer, period out of it, and there are zero carveouts for the OS itself around network traffic visibility.
- walterbell 9mo ago> how organizations can secure any device ios or android if they can't track and control the network layer, period out of it, and there are zero carveouts for the OS itself around network traffic visibility. The closest I've seen is an on-device VPN like Lockdown Privacy , but it can't block Apple bypassing the VPN. https://lockdownprivacy.com/ https://lockdownprivacy.com/ | https://github.com/confirmedcode/Lockdown-iOS https://github.com/confirmedcode/Lockdown-iOS
- Melatonic 9mo agoOr the tiny CPU on the networking hardware chip
- ThinkBeat 9mo agoYou cannot. iOS is one problem, but it goes for every other device/server/desktop/appliance that you use. You can take a lot of precautions, and mitigate some risk, and ensure that operations can continue even if something bad happens¹, but you cant ever "be safe". ¹ "" There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don't know we don't know "" (Often attributed to Donald Rumsfeld, though he did not originate the concept.) Know what bad can happen is difficult.
- fsflover 8mo agoExcept Qubes OS, which often saves you even when an unknown unknown happens.
- JensenTorp 9mo agoOutrageous that this isn't being patched in iOS 18. Genuinely shocked, and indefensible.
- p-t 9mo agoi wonder if this could be used to make a jailbreak possible :3
- burnt-resistor 9mo agoSubmit feedback (or radar equivalents) to Apple about the nasty rug-pull of not patching 18 on all devices. Don't expect a response however. https://www.apple.com/feedback https://www.apple.com/feedback
- zerotolerance 9mo agoApple has some of my favorite vulnerabilities, most notably GOTO Fail: https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html
- riggsdk 9mo agoWhenever plugging a hole like this, the OS should kinda leave it “open” as a kind of honeypot and immediately show a warning to the user that some exploit was attempted. Granted, the malware will quickly adapt but you should at least give some users (like journalists or politicians) the insanely important information about them being targeted by some malicious group.