Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
thehackernews.com Nov 5, 2026

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency added CVE‑2024‑27834, a medium‑severity Apple flaw, to its Known Exploited Vulnerabilities catalog after reports of active attacks. The vulnerability, fixed in May 2024 across iOS, iPadOS, macOS, tvOS, watchOS, and Safari, allows attackers to bypass Pointer Authentication and gain arbitrary read/write access. Russian‑linked APT29 exploited the patch‑level flaw via malicious JavaScript on compromised or fake websites and a supply‑chain attack, delivering an info‑stealing payload. Federal agencies are urged to apply patches by November 18, 2026.

💡 Why It Matters

  • · The incident shows that even recently patched Apple systems can be weaponized by sophisticated state actors, underscoring the need for continuous vigilance and rapid patch deployment in critical infrastructure.