Vendor

Apple

Vulnerabilities and malware affecting Apple's platforms — macOS, iOS, iPadOS, and Safari — including PAM-abusing stealers, cross-platform RATs, and the Mac-native malware families that have moved from novelty to fixture in enterprise threat models.

CVEs

CVE-2024-27822

[ HIGH ] CVSS 7.8 patched

macOS PackageKit LPE via ~/.zshenv sourced under installer root context

macOS PackageKit runs PKG-installer shebang scripts under root, and zsh shebangs source ~/.zshenv from the calling user's home before the script body runs, yielding local privilege escalation. Fixed in macOS Sonoma 14.5 (May 2024).

Apple / macOS PackageKit (Installer.app framework) May 14, 2024

Articles

~/articles/2026-07-21-apple-hide-my-email-mail-logs-july3-fix-year-disclosure

● Breaking

apple

Apple fixes Hide My Email leak, year after disclosure

Apple deployed a July 3 fix for a Hide My Email flaw that unmasked real addresses in Mail logs — disclosed to Apple over a year earlier per 404 Media.

Jul 21 read →

~/articles/2026-07-13-jamf-crashstealer-werkbit-notarized-macos-stealer

apple

Notarized Werkbit.app carries CrashStealer past Gatekeeper

Jamf flagged CrashStealer, a native-C++ macOS infostealer arriving inside Werkbit.app — Apple-notarized and gated behind a meeting PIN.

Jul 13 read →