Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
Product
Safari
- Mentions · 7d14
- Mentions · 30d20
- All mentions28
- First seenAug 15, 2026
- Last mentioned11h ago
Timeline
28 articles · newest firstDarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
76
Unreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
74
Apple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more
Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.
48
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
76
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74
Safari type confusion bug allows remote code execution
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
58
Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
76
Apple patches 286 iOS and macOS bugs, backports exploited flaw
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
76
Safari 27.2 fixes LinkPresentation crafted-image memory issue
The issue is listed for Safari on macOS Sequoia and macOS Tahoe, and the memory impact is truncated.
36
Apple October 2026 updates patch 304 flaws, including prior exploit
Already exploited CoreGraphics flaw CVE-2026-86950 now gets iOS 18 fixes; no newly exploited bug is flagged.
76
Apple Blocks Compromised eMudhra Intermediate CAs
Apple is blocking certificates from six compromised eMudhra intermediate CAs that issue TLS certificates, with further updates for command-line tools.
45
Chrome warns Enhanced Protection users before they run ClickFix commands
Copied commands are scrubbed and checked by Safe Browsing, and Chrome is also expanding scam and financial-ad checks.
46
Safari and WebKit block services that turn emails into tracking IDs
The blocks ship in iOS 27, iPadOS 27, macOS 27, and visionOS 27 and stop pages from sending addresses to identity-resolution servers.
34
Product showcase: GuardOS checks QR links, scans for data breaches, and filters Safari content
GuardOS for iPhone bundles Safari filtering, breach lookups, QR-link checks, and photo storage cleanup.
18
Apple's new 'Switch to Safari' campaign details why you should ditch Chrome
Apple launched a Switch to Safari campaign claiming better privacy and speed than Chrome.
6
Safari History Database Tags Can Reveal Users’ Browsing Themes in Forensic Investigations
Safari History.db stores Wikidata-linked topic tags that can reveal browsing themes in macOS investigations.
36
Safari History Database Tags Can Reveal What Users Were Browsing on macOS
Safari History.db topic tags can reveal macOS browsing themes even after some history records are removed.
36
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
Ukraine warns Russian-aligned hackers are infecting military and officials' iPhones and Android phones for espionage.
76
Fake iPhone Duo preorder scam triggers DarkSword attack
A fake iPhone Duo preorder page uses the patched DarkSword chain to steal iPhone data on visit.
74
APPLE-SA-09-14-2026-9 Safari 27
Apple's Safari 27 update fixes a flaw letting a malicious site detect installed apps.
36
Apple security advisory (AV26-930)
CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.
35
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
75
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
58
ZDI-26-610: Apple Safari JavaScriptCore B3 ReduceStrength Phase Use-After-Free Remote Code Execution Vulnerability
ZDI details a use-after-free in Apple Safari's JavaScriptCore (CVE-2026-64715) that allows remote code execution after a user visits a malicious page.
30
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.
58
Related CVEs
by mentions- CVE-2026-98432<1%9.8Use-after-free in Linux kernel IPv4 TCP options
- CVE-2026-330961%7.5Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network
- CVE-2026-8695026%8.8Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
- CVE-2025-43510<1%7.8Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
- Logic flaw lets low-priv attacker run code as root on macOS
- Out-of-bounds write in Apple OS via a local app
- Camera access without permission on Apple devices
- Out-of-bounds read when Apple platforms process a 3D model
- Out-of-bounds read in Apple OSes via a crafted file
- Type confusion in Safari via crafted web content
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.