Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

Summary: CISA added CVE-2024-27834, a medium-severity improper authentication flaw (CVSS 5.5) in multiple Apple operating systems, to its Known Exploited Vulnerabilities catalog on Wednesday after reports of active exploitation. Apple patched the flaw in May 2024 across iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5, and it had been demonstrated as a zero-day at Pwn2Own Vancouver in March.
Why it matters: Sekoia attributed the exploitation to APT29, a Russian state-sponsored group, with moderate to high confidence, using compromised sites, fake sites, and a supply chain attack on Plerdy SEO Tracker to deliver an information-stealing payload. FCEB agencies have until November 18, 2026 to patch, a deadline that leaves a long window for a flaw already under active attack.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2024-27834 CVE-2025-43529
Related: Dark Sword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover Cyber Risks ·
CISA Adds One Known Exploited Vulnerability to Catalog Cyber Risks · Nov 04, 2026
CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability Known Exploited Vulnerabilities · Nov 04, 2026