CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

concinds an hour ago | parent | next [-]

I wonder how well Apple has deployed these tools internally for security research.

Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has deployed this tooling as much as Google.

	▲	JCattheATM 10 minutes ago \| parent [-]
		I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.

▲

Aurornis an hour ago | parent | prev | next [-]

More than 26.5:

> The affected releases include iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.

I’ve already seen a lot of people self-congratulating for not updating to Tahoe but this isn’t exclusive to Tahoe.

	▲	dragonsenseiguy an hour ago \| parent [-]
		Ah thanks! I was only looking at Tahoe since my mac had an update and I usually look at the security release notes.

▲

neuronexmachina an hour ago | parent | prev | next [-]

CVEs:

* https://nvd.nist.gov/vuln/detail/CVE-2026-28952

* https://nvd.nist.gov/vuln/detail/CVE-2026-28942

▲

fosterfriends 2 hours ago | parent | prev | next [-]

Kernel Available for: macOS Tahoe

Impact: An app may be able to cause unexpected system termination

Description: An integer overflow was addressed with improved input validation.

CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research

▲

three_burgers an hour ago | parent | prev | next [-]

CVE-2026-28952 is about an integer overflow due to lack of input validation. I wonder what makes such vulnerability difficult to discover by traditional SAST tools?

	▲	firesteelrain 18 minutes ago \| parent [-]
		Fuzzing, dynamic analysis or DAST might have found it too. Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

▲

embedding-shape 2 hours ago | parent | prev | next [-]

Claude and Anthropic is mentioned, but not Mythos, I'm guessing this would mean then this was found outside of the whole Mythos thing, or would there be any reason for them not to mention it, if it was involved?

	▲	sigmar an hour ago \| parent [-]
		It was Mythos >Our engineers, working together with Mythos Preview, built a working exploit in five days. https://news.ycombinator.com/item?id=48139219

▲

vessenes 2 hours ago | parent | prev | next [-]

For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game.

I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same time having reduced maintenance costs since you can have some agentic help on backporting.

	▲	mort96 13 minutes ago \| parent \| next [-]
		Staying one point release behind is weird isn’t it? I get staying a major release behind, Apple’s x.0 releases are often pretty rough so it might be worth staying on x-1 for a while. But point releases mostly just fix the stuff they broke in the major release.. Would you really upgrade from 18.5 or whatever to 26.0 when Apple releases 26.1?
	▲	samtheprogram 41 minutes ago \| parent \| prev \| next [-]
		Security updates still go out for older major releases back 2 versions. You didn’t need to jump to 26 if you weren’t on it.
	▲	dragonsenseiguy 37 minutes ago \| parent \| prev [-]
		Same! I almost never updated, now I feel like i need to update. Kinda feels like FOMO but for security updates

▲

ZPrimed an hour ago | parent | prev | next [-]

This isn't a 26.5 bug, this is a bug fixed in 26.5.

	▲	dragonsenseiguy an hour ago \| parent [-]
		Ah my bad for the wrong wording.

▲

dragonsenseiguy an hour ago | parent | prev | next [-]

Sidenote but: it's crazy how big this update is. 13 GB is crazy

	▲	jshier 42 minutes ago \| parent [-]
		Update from 26.3 to 26.4 for the Studio Display XDR was 2.4GB. And that's for a variant of iOS designed for screens.

▲

fl1pper 2 hours ago | parent | prev | next [-]

Where all of this is going? Will there be a dedicated servers running coding agents that iterate throught codebases for each company to find vulnerabilities 24/7?

▲

Aurornis an hour ago | parent | next [-]

More like: There will be a budget for tokens to be spent on security audits.

1000 different companies will be pitching your CTO their proprietary vulnerability scanning harness as the most cost effective.

	▲	colejohnson66 an hour ago \| parent [-]
		So what already happens, but worse?

▲

vessenes 2 hours ago | parent | prev [-]

Yes

▲

sda2 2 hours ago | parent | prev [-]

One more reason to avoid upgrading to Tahoe.

	▲	hedgehog an hour ago \| parent \| next [-]
		This was fixed in 26.5 as well as 15.7.7 etc. https://app.opencve.io/cve/CVE-2026-28952
	▲	dragonsenseiguy an hour ago \| parent \| prev [-]
		> One more reason to avoid upgrading to Tahoe. Sequoia also has security bugs :) https://support.apple.com/en-us/127116