Apple
CompanyVulnerabilities
105 CVEs in our records, 0 known exploited (on CISA's KEV list).
Source: NVD and CISA KEVThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by Cyber Security NewsOlder iPhones storing crypto seed phrases face physical BootROM attack risk
- Malware reported by Cyber Security NewsApple sends new mercenary spyware threat notifications to iPhone users in 99 countries
- Activity reported by CyberScoopApple warns users in 99 countries of mercenary spyware attacks, over 150 countries notified to date
- Activity reported by Cyber Security NewsCoruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Recent news
Older iPhones storing crypto seed phrases face physical BootROM attack risk
Researchers disclosed the usbliter8 BootROM exploit in June 2026, which extends checkm8-style attacks to Apple's A12 and A13 chips, including the iPhone XS, XR, iPhone 11 family and second-generation iPhone SE. An attacker with physical access and cheap USB hardware can run unsigned code before iOS loads, but the Secure Enclave is not directly compromised, so wallet theft would need further weaknesses. OneKey founder Yishi warns that wiping and offlining an old iPhone does not make it a secure cold wallet.
Torvalds says Linux 7.4 merge window is large, welcomes AI-driven fixes as healthier
The first release candidate for Linux kernel 7.4 is out, with almost 20,000 commits in the merge window against a usual figure of around 15,000. Torvalds says many fixes are for issues found by AI, and that AI-suggested patches are increasingly appearing, though they are often rewritten. Notable additions include improved support for AMD, Apple and Google processors and some virtual machine security tweaks.
Weekly roundup: Binance theft, Chrome and Firefox fixes, and Homeland Security data leak
The roundup covers a reported $6.3 billion crypto theft from Binance, described as the largest ever, and a breach in which hackers stole and published data on 41,000 Homeland Security workers. Other items include fake PDF and search tools that hijacked searches for 13.4 million Chrome users, malicious Firefox extensions impersonating crypto wallets, and a Quest breach exposing patient records. It also flags Chrome and Firefox security updates, an Apple update for older iPhones and iPads, and concerns about Samsung TVs and Popcorn Time's forgotten updater. The article gives headlines only, so technical details must come from the linked original reports.
FBI attributes record $6.3B Binance hack to North Korea
The FBI has linked the record $6.3B Binance hack to North Korea and is seeking private-sector help to block further laundering of the stolen digital assets. Risky Business News also reports that the FBI has confirmed the attribution.
Apple's HomeView may gain security camera features, according to code hints
Strings found in HomeView 27.2 code by a Reddit user suggest Apple may add a security camera mode with motion detection, live streaming, recording and privacy functions. Reported setup text references HomeKit Secure Video, and the feeds would reportedly be visible only to home members, with an indicator light and sound when viewed or recording.
Apple sends new mercenary spyware threat notifications to iPhone users in 99 countries
Apple has issued a new wave of threat notifications to selected iPhone users in 99 countries, reported by researcher Costin Raiu on 30 October 2026 and separate from the August alerts that covered 110 countries. Apple says more than 150 countries have been notified in total, but these figures refer to user locations, not confirmed infections. Apple has not named the attackers, the spyware product or any software flaw involved.
Russia again pulls VPN apps from Apple's App Store, EFF calls it a crackdown
VPN app developers report that their products have again been removed from Apple's App Store in Russia. The EFF says this follows earlier Roskomnadzor action against VPN apps and a Russian move to add Apple and Microsoft to its state surveillance registry, which reportedly gives authorities access to local users' correspondence.
Apple warns users in 99 countries of mercenary spyware attacks, over 150 countries notified to date
Apple issued a new round of threat notifications to targeted users in 99 countries, bringing its total to over 150 countries. Apple does not attribute the attacks to any specific attackers or regions. Citizen Lab and Access Now advise recipients to enable Lockdown Mode and contact Access Now, and warn that the absence of a notification does not rule out infection. The previous major batch was sent in August, and the latest one comes shortly before final negotiations on industry standards under the voluntary Pall Mall Process.
Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Zimperium zLabs documented 608 domains delivering Coruna-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.
Columnist mocks Apple's foldable iPhone cracks and touch-screen laptop plans under new CEO John Ternus
An opinion column criticises Apple for launching a touch-screen laptop and for reports of cracking in its foldable iPhone, which the author calls the "iPhone Duo". The author describes Apple under new CEO John Ternus as relying on gimmicks and borrowing ideas from rivals, and argues that Apple's recent direction is struggling.