Here is the part that should bother you: there is no new patch to wait for. On Wednesday, November 4, CISA added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog \u2014 the list of bugs it has evidence are being used in real attacks. Apple fixed this one in May 2024. If your iPhone, iPad, or Mac is current, you have been protected for about eighteen months. If it is not, a state-linked campaign has been looking for you.<\/p>\n
The flaw sits in WebKit, the engine behind Safari. It is classed as improper authentication, and in plain terms it lets an attacker who already has arbitrary read and write access bypass Pointer Authentication. Pointer Authentication is a hardware-backed check on Apple processors that signs memory pointers, so corrupted memory is harder to turn into running code. Bypassing it does not break into a phone by itself. It removes a lock that keeps a first break-in from becoming a full exploit.<\/p>\n
That is exactly how it is being used \u2014 as one link in a chain. The CISA listing follows a report from the security firm Sekoia on a campaign it calls Poisoned Source. Sekoia attributes the activity, with moderate to high confidence, to APT29 \u2014 also known as Cozy Bear and Midnight Blizzard, a group affiliated with Russia’s Foreign Intelligence Service. I am repeating that as Sekoia’s assessment, not as a proven fact, because attribution is an assessment and this one is worded that way by the researchers themselves.<\/p>\n
According to Sekoia, as reported by The Hacker News and SecurityAffairs, the attackers reached visitors three ways: compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack on Plerdy SEO Tracker, an analytics script other sites load. A visitor’s device was profiled first, then malicious JavaScript triggered a chain combining a WebKit remote code execution flaw with this bypass. The payload was information-stealing malware built to harvest browser cookies and device data. Steal the cookies, and you can often reuse someone’s logged-in sessions without learning their password.<\/p>\n
Apple addressed the flaw back in May 2024 with improved checks in iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The bug had been demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024. None of that is new. What is new is CISA saying, on November 4, that it is now being exploited, and giving federal agencies until November 18, 2026 to make sure they have remediated it.<\/p>\n
The score will mislead you if you let it. CISA and the reporting put CVE-2024-27834 at 5.5 out of 10 \u2014 medium severity. Read alone, that sounds like something you can defer. Read correctly, it is a chain component: it needs another flaw to give the attacker read and write access first, and then it makes that access far more useful. Exploit chains are built out of exactly this kind of medium-rated piece, because the pieces are what the defense was counting on to stop the chain.<\/p>\n
Now the other side, because I will not hype this. If your Apple devices are up to date, this flaw is already closed for you, and has been since 2024. This is not a new hole in current iPhones. The risk is concentrated in the long tail: older phones and tablets that stopped being updated, a Mac deferring its update for months, a spare device in a drawer that still signs into email. Those are the devices a watering-hole campaign like this is built to catch, precisely because their owners think of them as harmless.<\/p>\n
There is also a website lesson here. One delivery route was a third-party analytics script loaded by other people’s sites. Every tracker you add to a website is code you are asking your visitors to trust. If you run a site, that supply chain is part of your security.<\/p>\n
First, update every Apple device you own, not just your main phone. On iPhone and iPad, go to Settings, then General, then Software Update, and install what is offered. On a Mac, use System Settings and Software Update, which also brings Safari current. Do not aim for the old fixed versions I listed above \u2014 those are the floor from 2024. Install the latest version your device is offered.<\/p>\n
Second, turn on automatic updates and leave them on. This campaign worked, to the extent it worked, against devices that had missed patches that already existed. Automatic updates are the boring control that closes that gap while you sleep.<\/p>\n
Third, decide about devices that cannot update anymore. If a phone or tablet can no longer get current Apple software, do not keep using it for email, banking, or anything signed in \u2014 a stolen cookie does not care that the device is “just a spare.” Retire it or keep it off your accounts.<\/p>\n
Fourth, if you run a website, audit its third-party scripts. Remove trackers you no longer use and know which ones remain, because the Plerdy route is the general pattern: compromise one widely loaded script, and you reach every site that loads it.<\/p>\n
My bottom line: do not panic about a 5.5, and do not shrug at it either. Check your oldest Apple device today. That is where this one lives.<\/p>\n
Sources: The Hacker News, “Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says” (November 5, 2026) \u2014 thehackernews.com\/2026\/11\/hackers-exploit-patched-apple-flaw-to.html<\/a>; SecurityAffairs, “U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog” (November 5, 2026) \u2014 securityaffairs.com<\/a>; CISA Known Exploited Vulnerabilities Catalog, entry for CVE-2024-27834 (added November 4, 2026, due November 18, 2026) \u2014 cisa.gov\/known-exploited-vulnerabilities-catalog<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Here is the part that should bother you: there is no new patch to wait for. On Wednesday, November 4, CISA added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog \u2014 the list of bugs it has evidence are being used in real attacks. Apple fixed this one in May 2024. If your […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-178","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=178"}],"version-history":[{"count":0,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/178\/revisions"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}