Found 48 bookmarks
Newest
Apple Patches Major Security Flaws in iOS, macOS Platforms
Apple Patches Major Security Flaws in iOS, macOS Platforms
Apple rolls out iOS and macOS platform updates to fix serious security bugs that could be triggered simply by opening an image or video file. Apple on Monday pushed out patches for security vulnerabilities across the macOS, iPhone and iPad software stack, warning that code-execution bugs that could be triggered simply by opening a rigged image, video or website. The new iOS 18.5 update, rolled out alongside patches for iPadOS, covers critical bugs in AppleJPEG and CoreMedia with a major warning from Cupertino that attackers could craft malicious media files to run arbitrary code with the privileges of the targeted app. The company also documented serious file-parsing vulnerabilities patched in CoreAudio, CoreGraphics, and ImageIO, each capable of crashing apps or leaking data if booby-trapped content is opened. The iOS 18.5 update also provides cover for at least 9 documented WebKit flaws, some serious enough to lead to exploits that allow a hostile website to execute code or crash the Safari browser engine. The company also patched a serious ‘mute-button’ flaw in FaceTime that exposes the audio conversation even after muting the microphone. Beneath the interface, Apple said iOS 18.5 hardens the kernel against two memory-corruption issues and cleans up a libexpat flaw (CVE-2024-8176) that affects a broad range of software projects. Other notable fixes include an issue in Baseband (CVE-2025-31214) that allows attackers in a privileged network position to intercept traffic on the new iPhone 16e line; a privilege escalation bug in mDNSResponder (CVE-2025-31222); an issue in Notes that expose data from a locked iPhone screen; and security gaps in FrontBoard, iCloud Document Sharing, and Mail Addressing.
#securityweek#EN#2025#Apple#macos#ios#update#file-parsing#vulnerabilities
·securityweek.com·
Apple Patches Major Security Flaws in iOS, macOS Platforms
TTP - Apple Offers Apps With Ties to Chinese Military
TTP - Apple Offers Apps With Ties to Chinese Military
Millions of Americans have downloaded apps that secretly route their internet traffic through Chinese companies, according to an investigation by the Tech Transparency Project (TTP), including several that were recently owned by a sanctioned firm with links to China’s military. TTP’s investigation found that one in five of the top 100 free virtual private networks in the U.S. App Store during 2024 were surreptitiously owned by Chinese companies, which are obliged to hand over their users’ browsing data to the Chinese government under the country’s national security laws. Several of the apps traced back to Qihoo 360, a firm declared by the Defense Department to be a “Chinese Military Company." Qihoo did not respond to questions about its app-related holdings.
#techtransparencyproject#EN#2025#Apple#Chinese#Military#VPN#ios#AppStore
·techtransparencyproject.org·
TTP - Apple Offers Apps With Ties to Chinese Military
Apple Confirms Governments Using Push Notifications to Surveil Users - MacRumors
Apple Confirms Governments Using Push Notifications to Surveil Users - MacRumors
Unidentified governments are surveilling smartphone users by tracking push notifications that move through Google's and Apple's servers, a US... In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from the tech giants to track smartphones. The traffic flowing from apps that send push notifications put the companies "in a unique position to facilitate government surveillance of how users are using particular apps," Wyden said. He asked the Department of Justice to "repeal or modify any policies" that hindered public discussions of push notification spying.
#macrumors#EN#2023#privacy#iOS#iPhone#iPad#Apple#push#surveillance
·macrumors.com·
Apple Confirms Governments Using Push Notifications to Surveil Users - MacRumors
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and maintain access to an Apple device even when the victim believes it is offline. The method "tricks the victim into thinking their device's Airplane Mode works when in reality the attacker (following successful device exploit) has planted an artificial Airplane Mode which edits the UI to display Airplane Mode icon and cuts internet connection to all apps except the attacker application," Jamf Threat Labs researchers Hu Ke and Nir Avraham said in a report shared with The Hacker News.
#thehackernews#EN#2023#iOS#apple#airplanemode#exploit
·thehackernews.com·
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
A Matter of Triangulation.
A Matter of Triangulation.
Hi all, Today we have very big and important news. Kaspersky experts have discovered an extremely complex, professionally targeted cyberattack that uses Apple’s mobile devices. The purpose of this attack is the inconspicuous introduction of spyware into the iPhones of employees of the company – both top and middle-management. The attack is carried out using
#kaspersky#EN#2023#iOS#0-Click#Triangulation#iphone#spyware#Apple
·eugene.kaspersky.com·
A Matter of Triangulation.