30
35
30
30
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
Researchers showed malicious SIM cards can issue RUN AT commands to execute code on Qualcomm modems, compromising Quectel-based cellular IoT devices like EV chargers.
Researchers at the University of Birmingham and Fuzzware found 9 of 26 tested devices accept SIM proactive commands, including six Qualcomm-based cellular modules, five of them Quectel. They achieved code execution on a commercial Autel EV charger via the Quectel EC25's atfwd_daemon unsafe format string, and demonstrated an irreversible 2G downgrade, modem power-off, and arbitrary file reads via a root TFTP daemon on a Quectel EG25-G. Attacks require a hostile SIM already in the slot or an interposer; no attacks have been reported in the wild. Qualcomm has built a hardened configuration disabling the interface by default and Quectel mitigated the file-access flaw; the paper was presented at USENIX WOOT.
50
35
30
30
30
30
35
35
30
35
Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds
Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.
SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.
42
30
Homebrew 7.0.0 is out, here’s what changed for security
Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.
Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.
40
35
30
30
30
30
30
30
35
30
30
35
30
35
30
30
35
30
30
30
35
35
35
30