Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
AI-summarised brief · reviewed before publication
The U.S. Cybersecurity and Infrastructure Security Agency added CVE‑2024‑27834, a medium‑severity Apple flaw, to its Known Exploited Vulnerabilities catalog after reports of active attacks. The vulnerability, fixed in May 2024 across iOS, iPadOS, macOS, tvOS, watchOS, and Safari, allows attackers to bypass Pointer Authentication and gain arbitrary read/write access. Russian‑linked APT29 exploited the patch‑level flaw via malicious JavaScript on compromised or fake websites and a supply‑chain attack, delivering an info‑stealing payload. Federal agencies are urged to apply patches by November 18, 2026.
💡 Why It Matters
- · The incident shows that even recently patched Apple systems can be weaponized by sophisticated state actors, underscoring the need for continuous vigilance and rapid patch deployment in critical infrastructure.