Native macOS Secure Enclave SSH keys work but feel awkward
The author rejected that built-in workflow after also weighing Secretive, YubiKey, and password-manager agents.
1
Stories per day · 30 days
25 RSS
Relatedapple20ios9clickfix7windows6infostealer5supply-chain5github4safari4accelerate-framework3claude3social-engineering3software-release3android2beta2claude-code2cloudflare2coregraphics2credential-theft2
187 stories, newest first · one card per story
Stories tagged #macos
Apple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
Apple lists macOS 27.2.1 (26B131) for download
The page gives build 26B131 and a download link, without describing changes or fixes.
Critical Terminal2Shell flaw grants instant shell on all OS
Design flaw in every terminal emulator on macOS Linux Windows and more allows attackers to gain instant shell with full user privileges with no patches available.
38
Every Mac since 2022 includes undocumented family classifier
Apple Intelligence builds a personal knowledge graph on Macs including family relationships from device data like contacts and photos.
1
Phexia malware tricks Mac users into running Terminal commands
Phexia steals passwords and browser data from infected macOS machines via ClickFix tricks.
1
Apple products contain pointer authentication bypass vulnerability
iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain improper authentication vulnerability allowing arbitrary read and write capability.
macOS 27 does not support CoreStorage volumes
macOS 27 breaks automatic mounting and erasing of CoreStorage volumes, rendering encrypted storage inaccessible.
1
Apple releases macOS 27.3 beta
macOS 27.3 beta is now available for download and testing.
Malicious Claude Code extension on Open VSX plants an SSH backdoor
OpenSourceMalware says anthropic.claude-code 2.1.313 adds an SSH key, reverse tunnel, and startup scripts; Anthropic’s official release is not shown compromised.
1
Show HN tool auto-dismisses macOS local-network prompts
The Hacker News post only shows the project title, with 42 points and 35 comments.
Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
1
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
2
Apple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more
Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
1
TeamViewer flaws before 15.83 allow code execution in sessions
Three high-severity bugs score up to 8.8, and TeamViewer reported no known active exploitation.
1
macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
macOS CoreText out-of-bounds read can disclose information
CVE-2026-112656 is scored CVSS 3.3 and requires opening a malicious page or file.
Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
Apple patches 286 iOS and macOS bugs, backports exploited flaw
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
Abandoned Popcorn Time updater risked takeover of millions of PCs
Eye Security sinkholed updater domains and pushed a disabling update to about 2 million Windows and macOS systems.
1
Apple releases macOS Golden Gate 27.2 security update
The posted note says a crafted image processed by Accelerate Framework may lead to an impact that the snippet cuts off.
Safari 27.2 fixes LinkPresentation crafted-image memory issue
The issue is listed for Safari on macOS Sequoia and macOS Tahoe, and the memory impact is truncated.
macOS Sequoia 15.8.2 fixes Accelerate denial of service
A local app can cause a denial of service; the posted description names no CVE.