vulnerabilities have already been fixed, and the system update was pushed 2026/05/11 †
> This document describes the security content of macOS Tahoe 26.5.
think: this is what we included with the tahoe 26.5 update 2 weeks ago
thanks ZPrimed (https://news.ycombinator.com/item?id=48273889)
Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has deployed this tooling as much as Google.
Typo, or I am just misreading?
This could also be an unofficial-official way for Apple to "leak" that yes, they do this--which is on brand for how Apple handles "rumors" etc.
You may think that not issuing a categorical denial is suspicious, but generally speaking you cannot infer any information from that response. If it was only used when really bad things might have happened, maybe you could infer more.
That there's no benefit to talking with the public is something that only Apple could believe.
Openness and honesty create trust. Secrecy creates distrust.
They've improved a lot, especially their phones, but I'd still never consider them a company that has a really strong focus on security.
For another example: macOS integrated antivirus in 2009, while Windows did so in 2012.
To this day nobody else ties their SMC, biometric auth, and HSM together as tightly and well as the T1 did. AS was further advancement of that.
Furthermore, Apple protects users against the legal changes that have allowed law enforcement to physically force someone to provide biometric credentials. By default MS just provides biometric auth to make it easier to log in to your system.
That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux distros started moving to a similar model.
Linux distros have always required sudo for "dangerous" things. What distros made users root by default?
The difference is Apple is much more likely to progressively make these legacy feature compatibility more difficult for users to configure over time, and to remove them eventually.
Microsoft's implementation was (twenty years later still is) a joke because it prompted users to hit enter or click a button.
Ironically Apple just recently added the same simpified approach.
It is the default (unless they changed it in the last 2 years or so). I know for a fact that my PC and Laptop don't ask for my password and I know for a fact that I reinstalled Windows on my laptop less than 2 years ago and changed nothing regarding the UAC prompt (the closest that is even remotely close is enabling sudo in the settings).
Yeah, they were. Virus writers were not targeting them as a platform because why develop for 10% marketshare when you can target 90% for free. It just wasn't worth it to target as a platform. So there was some level of protection due to lack of interest in distributed attacks, but the OS had very little protection against targeted attacks.
> Apple has led the pack in nearly every major OS security feature of the last 25 years.
What an absurd claim. Apple trails behind, it never leads in this space. Windows 7 had numerous protections that had become standards that Apple still lacked when Windows 10 came out.
Recently there was an Anki vulnerability that gave any website access to any local files. On Windows or Linux this would be deadly. On macOS, Anki can't access my desktop or documents or Chrome storage or password manager storage. I think Apple's been smart about which security features it prioritizes.
People always say this but there is no real relationship there. When hardware vendors add security technologies to the hardware, the major third party operating systems add support to use it pretty much immediately, and in many cases before the hardware even ships because the hardware vendor publishes the documentation ahead of time.
Try to name something where Apple was the first to support something (by a non-trivial amount of time) not because they were the first to add hardware support but because they released the combination of hardware and software in the time between when e.g. Intel or Qualcomm added hardware support and when Linux or Windows added software support to use it.
> The affected releases include iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.
I’ve already seen a lot of people self-congratulating for not updating to Tahoe but this isn’t exclusive to Tahoe.
Where does this quote come from? I can't see it in https://support.apple.com/en-us/127115, the article link at time of writing. It mentions CVE-2026-28952, but we're forced to guess why. I'd take the reference to mean that this issue is fixed, but I'm just some internet rando, so what the hell do I know?
If I do a google search for "CVE-2026-28952", it points me to various pages. Here's one, for example: https://www.cve.org/CVERecord?id=CVE-2026-28952 - which is a bit more explicit, though of course this is not from the horse's mouth:
> This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5
It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.
Maybe some day the fruit company with all their billions will be able to innovate a solution for deploying for example browser fixes so that they can be installed without requiring tens of gigabytes of free storage on the device. Meanwhile, we're stuck using a computer and iTunes for that.
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research
I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same time having reduced maintenance costs since you can have some agentic help on backporting.
e.g. macOS 15.0, 15.1, 15.3, 15.4, 15.6 and 15.7 all had .1 patches within a few weeks of release.
Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.
A lot of these issues would be highlighted by "legacy" (pre-AI) analysis tools. The issue is that they weren't being run.
Isn't the simpler explanation that they weren't just a tool run?
Software engineering is still kind of new overall.
It seems borderline impossible that there's a tool that they feel would be beneficial but that they're classed out of using by license costs or by staff proficiency.
https://www.blackduck.com/fuzz-testing.html
OpenText products
https://www.opentext.com/products/dynamic-application-securi...
I won’t say how much they are here but they are very expensive.
I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons
My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs
Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic!
- looking at components in isolation, not realizing that a component could receive untrusted input
- looking at the entire system, but not in a configuration that made the CVE possible
- having to be extremely lucky to find the issue through fuzzing, and Apple not hitting that jackpot
- having found the issue in testing, but incompletely/incorrectly fixing it
- mostly focusing testing on other components because this one’s code didn’t change and hadn’t seen issues in years
I don’t think we have enough info to know which (or something entirely different) it is.
I've had to be on top of updating everything constantly lately.
google has been running ClusterFuzz since ~2012, and naptime was announced in 2024 (https://projectzero.google/2024/06/project-naptime.html). they call it big sleep and codemender now.
openai announced aardvark last year, no they call it codex security.
1000 different companies will be pitching your CTO their proprietary vulnerability scanning harness as the most cost effective.
>Our engineers, working together with Mythos Preview, built a working exploit in five days.
An update to macOS 26.5 contains all the necessary code to update a Mac from 26.0 to 26.5 for both x86_64 and arm64 architectures.
They know which OS version is requesting an update, at least the version number part.
During the PowerPC to Intel transition, they did stuff like that; perhaps at their current scale, there's reasons why they don't.
Supporting both architectures enables a macOS install to boot an Intel Mac or an Apple Silicon Mac, which is useful in a dual-architecture environment.
It's easy to check for dual architecture support; just use the file command:
$ file /bin/ls
/bin/ls: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e]
/bin/ls (for architecture x86_64): Mach-O 64-bit executable x86_64
/bin/ls (for architecture arm64e): Mach-O 64-bit executable arm64eLarge majority of CVEs in the update are related to memory corruption, out of bounds and use after free.
Naturally the logic and wrong permissions ones would happen regardless of the language.
Sequoia also has security bugs :) https://support.apple.com/en-us/127116
For the record, this bug has nothing to do with our recent MIE attack [1] [2], which exploited two different kernel bugs. Our bugs are not fixed yet.
[1] https://blog.calif.io/p/first-public-kernel-memory-corruptio...
[2] https://news.ycombinator.com/item?id=48139219