Apple issued warnings across 99 nations as the Apple mercenary spyware threat targets investigative journalists with sophisticated surveillance tools.

Related Posts:

• BITTER PapRAT Malware Targets South Asian Organizations
• Hugging Face Malware Campaign Infects AI GPU Servers
• PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation

The post Apple Mercenary Spyware Threat Prompts Global Alerts appeared first on Daily CyberSecurity.

The iPhone Duo likely won’t make it into Santa’s sleigh this year. Here’s what Apple had to say about it.

What did you last record on your iPhone? A lecture, perhaps, a call with your landlord, or notes…

Older iPhones that store cryptocurrency recovery phrases are at a continuous security risk due to unpatchable BootROM vulnerabilities, even if the devices are wiped and kept in airplane mode. While attackers require physical access to exploit this vulnerability, doing so does not automatically reveal encrypted wallet data. However, other weaknesses could potentially allow them to […]

The post Unpatchable Hardware Flaws in Older iPhones Allow Attackers to Steal Crypto Wallet Recovery Phrases appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Dutch spies, Russian hackers and Jared Kushner’s iPhone. It sounds like the ingredients for a thriller, but according to claims in a new book the US President's son-in-law may have been hacked twice. Is any of it true, and what does it tell us about the phones in our pockets? Meanwhile, James Ball explains that of the internet’s most trusted security keys were protected by numbers so small that one of them was... four. Yes, "4". And then, of course, to make the week worse we suffered a PHPocalpyse... Plus, Chuck Randolph of 360 Privacy explains how the internet has made it scarily easy to put company executives and public officials in danger. All this and more in episode 490 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.

Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad.

The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to an older one. Here, Apple has made the fix available to older devices running iOS 18, so they can be protected without upgrading to an operating system they don’t support.

Updates for your particular device

The table below shows which updates are available and links to Apple’s security information for each one.

Name and information link	Available for
iOS 27.2 and iPadOS 27.2	iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
iOS 26.7.2 and iPadOS 26.7.2	iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
iOS 18.7.11 and iPadOS 18.7.11	iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
macOS Golden Gate 27.2	macOS Golden Gate
macOS Tahoe 26.7.2	macOS Tahoe
macOS Sequoia 15.8.2	macOS Sequoia
tvOS 27.2	Apple TV 4K 2nd generation and later
watchOS 27.2	Apple Watch Series 9 and later
visionOS 27.2	Apple Vision Pro (all models)
Safari 27.2	macOS Sequoia and macOS Tahoe
tvOS 26.6.1 (no published CVE entries)	Apple TV HD and Apple TV 4K 1st generation

How to update your Apple devices

How to update your iPhone or iPad

For iOS and iPadOS users, here’s how to check if you’re using the latest software version:

Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

How to update your Mac

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Keep your Mac plugged in and connected to the internet until the update is done.

How to update your Safari browser

Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:

• Open the Apple menu > System Settings > General > Software Update.
• If you see a Safari update listed separately, click Update Now to install it.
• Restart your device when prompted.

Technical details

The headline bug is CVE-2026-86950, in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The result is that “processing a maliciously crafted file may lead to arbitrary code execution.”

Apple says it is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27.

That wording indicates Apple believes the bug was used in real attacks against a limited group of users.

Usually, journalists, activists and officials are the targets of this kind of attack. If you think you could be a target of highly sophisticated spyware, you should update, restart your phone, and consider applying Apple’s Lockdown Mode.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}

Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics zero-day exploited in the wild, on older iPhones and iPads. Update now.

Related Posts:

• Apple iOS 27.2 Update Fixes 160 Security Flaws
• CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface
• HashiCorp Patches Critical 9.9 CVSS Consul-k8s Authorization Bypass Vulnerability (CVE-2026-110720)

The post Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones appeared first on Daily CyberSecurity.

Some displays are failing within hours of unboxing. Apple is offering replacements, but is the issue really that widespread?

Apple deployed an in-box Apple Presto return scanner across retail stores to combat return fraud by running diagnostics on sealed iPhones.

Related Posts:

• Come Back to Firefox Campaign Champions Web Privacy
• OpenSSL 4.1.0 Release Introduces Elbrus Support and DTLS 1.3
• eMudhra Rogue Certificates Flood Certificate Transparency

The post Apple Presto Return Scanner Targets In-Box Fraud appeared first on Daily CyberSecurity.

The UK CMA proposed reforms to unlock iPhone contactless payments, demanding Apple lower developer fees and open its closed NFC ecosystem.

Related Posts:

• Chrome ClickFix Protection Scans Risky Clipboard Commands
• cURL Vulnerability Reporting Policy Shifts to GitHub
• Apple Blocks WebKit Identity Resolution in Privacy Shift

The post UK CMA Moves to Unlock iPhone Contactless Payments appeared first on Daily CyberSecurity.

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:

Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.

[…]

According to Cellebrite, AU:

• is a “next-generation AFU vector that is more resilient to Apple’s OS changes”
• works with Stolen Device Protection enabled, which tightens USB restrictions
• is enabled by a dedicated appliance with a stated range (!) of about 8 meters.

AU = Advanced Unlocks, Cellebrite’s term. AFU = after first unlock.

Estimates for Duo preorders are now showing a ship date of late January, marking a new wait time record for Apple and its customers.

404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours.

The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that allows them to unlock and access data stored in iPhones and Android smartphones. Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.

“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable. GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data ­- such as cached locations, and recently deleted photos and iMessages ­- after a certain number of days. “We’re gonna be able to preserve that data for an infinite amount of time.”

Presumably, now that Apple engineers know that this flaw exists they can find and fix it. AI turns out to be really good at this sort of thing.

Another news article.

Apple patched an iPhone flaw that may have been exploited in targeted attacks. Here’s what iOS 26 users need to know and how to update.

The post iPhone Security Warning: Apple Says iOS 26 Flaw May Have Been Exploited appeared first on TechRepublic.

Apple’s iOS 27.0.1 fixes three iPhone problems involving Face ID restarts, camera artifacts, and an unresponsive touchscreen.

The post iOS 27.0.1 Is Here: 3 iPhone Problems Apple Just Fixed appeared first on TechRepublic.

Apple is rolling out new parental controls for iPhone, iPad and Mac, including website approvals, Screen Time changes and expanded safety tools.

The post Apple Adds New Parental Controls to iPhone, iPad and Mac: Here’s What Changes appeared first on TechRepublic.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Fale com RDS · (47) 98861-8255

Apple is warning iPhone users about FaceTime scams. Learn how the fraud works, what Apple recommends, and how to report suspicious calls.

The post Apple Warns Millions of iPhone Users: FaceTime Scams Are Spreading appeared first on TechRepublic.

Apple is releasing some iPhone security fixes earlier as AI raises concerns about faster cyberattacks and shorter patch windows.

The post iPhone Security Fixes May Arrive Sooner as AI Speeds Up Threats appeared first on TechRepublic.