About the security content of macOS Tahoe 26.6

Posted by andor 6 days ago

Counter212Comment149OpenOriginal

Comments

Comment by tengwar2 6 days ago

15.7.8 is out today as well, with these security fixes: https://support.apple.com/en-us/128071.

For context, there have been issues with MacOS 26 which have led many people to defer upgrading until MacOS 27 is available, and MacOS 15 is the previous version.

Comment by jghn 6 days ago

> For context, there have been issues with MacOS 26 which have led many people to defer upgrading

For me the issue is liquid glass. Which I doubt is getting fixed any time soon

Comment by illithid0 6 days ago

Also a liquid glass hater, but for what it's worth, 27 is supposed to make it a little bit better. I would prefer to go back to what I had before I had to upgrade into this horrible UI, but this is better than nothing.

https://www.cultofmac.com/news/liquid-glass-changes-ios-27-m...

Comment by hbn 6 days ago

I've been running the 27 beta and it fixes so much of the ugliness I hated in Tahoe. Lots of places had toolbars restored, solid areas that indicate where the window can be grabbed. The shitty icon spam in menus is back to sanity. And window corner radii are consistent and less bulbous.

Comment by noname120 6 days ago

macOS 17 is decisively faster on my MacBook Air M1 16 GB than macOS 26/27 is on my MacBook Pro M2 Max 32 GB. And I don’t mean just the animations themselves but lag/sluggishness/responsiveness in general.

Comment by classified 6 days ago

There is no macOS 17.

Comment by noname120 5 days ago

Gosh I thought I had edited it to macOS 15, now it’s too late

Comment by 6 days ago

Comment by iknowstuff 6 days ago

Slower than 15 though

Comment by lapcat 6 days ago

> this is better than nothing.

Having installed the beta, I think that's the best you can say about it.

Comment by etempleton 6 days ago

Also on the beta. Agreed. Definite visual and UX improvement over 26, fixing the most egregious issues with 26 implementation of Liquid Glass, but maybe not quite as good as 25 overall.

Comment by lapcat 6 days ago

> not quite as good as 25 overall

Nothing will ever be as good as 25.

Because macOS 25 does not exist. ;-)

Comment by etempleton 6 days ago

Ahhh, my mistake. macOS 15 not to be confused with macOS 10.15

Comment by Jolter 6 days ago

I hear it’s slower? Can you comment on that?

Comment by Tagbert 6 days ago

The 27 betas? No, they are generally faster than 26.

Comment by lapcat 6 days ago

I haven't noticed or heard that it's slower.

Comment by Jolter 6 days ago

Nice, thanks for that.

Comment by alwillis 6 days ago

Definitely not slow.

Comment by illithid0 6 days ago

As long as the UI improves and I can ignore all the AI stuff they're starting to push through, that's fine with me, though like many longtime macOS users, I'm not holding my breath for a bug-free experience.

Comment by ChrisMarshallNY 6 days ago

> AI stuff they're starting to push through

iOS 26 anecdote:

A couple of weeks ago, I had a Baltimore Oriole (a cool-looking bird, not a baseball player) in my yard. They aren't rare, per se, but they are uncommon.

Took my iPhone out to snap a picture, and pressed the camera button. I hadn't used it, since upgrading to 26.

It takes the picture. It's there. I can see it, but it won't let me save it. Instead, it wants to tell me about the cool new voice-activated AI retouch feature. There was no way to save.

I probably could have figured it out, but I was so furious, I just nuked the picture.

Comment by DHPersonal 5 days ago

Holding down the camera button does open the AI search for me instead of the Camera app. This can be disabled, if I remember correctly.

Comment by ChrisMarshallNY 3 days ago

It was a one-time thing. I have that button set for the app. I have the long-press set for manual tweaking. I assume that this was trying to get me to use AI, instead.

Comment by pseudosaid 5 days ago

for real? it did, like every subsequent photo taken on the device after pressing the shutter “button”. You must be a bot, just another living shill. another confident user error in the field

Comment by ChrisMarshallNY 3 days ago

It was a first-time onboarding thing. After that first time, it didn’t happen again.

Fairly typical kind of workflow, that most apps do, these days. It’s just that the timing couldn’t have been worse.

> You must be a bot, just another living shill. another confident user error in the field

I have no idea what that means.

Comment by dylan604 6 days ago

> though like many longtime macOS users

For those of us older than just 10 years of using macOS, the older Apple OSes have instilled within us the desire to never install the X.0 release and wait until at least the X.1 release. The bug-free experience is a myth

Comment by D-Coder 5 days ago

> wait until at least the X.1 release

I think that applies to almost all software, not just Apple OSes. After all, Confucius said: "The only thing worse than old software is new software."

Comment by trollbridge 6 days ago

You can almost turn it off on the 27 beta, and 27 seems to perform a lot better too.

Comment by flohofwoe 6 days ago

You can already turn off most glass effects in 26 via "System Settings => Accessibility => Display => Reduce Transparency".

I had that turned off years ago (for reasons I don't remember), and was wondering what all the fuzz was about when 26 came out because I didn't see much of a difference ;)

IMHO the actual important visual changes in the 27 beta is that rolls back the bizarre oversized corner radius in Finder windows, and they also got rid of the 'every menu item must have an icon' idea.

Comment by trollbridge 6 days ago

27 seems superior to 26 in almost every way, although I'm still on a fairly old beta.

Comment by SanjayMehta 6 days ago

It's the first thing I turn off on a new iPhone or iPad. Started around ten years ago in the release which had animated app icons. Induced nausea.

Comment by trollbridge 5 days ago

Yep. That’s why it’s in accessibility - some people can’t handle it. Other useful options are reduce motion, reduce transparency…

Comment by Melatonic 5 days ago

I think that is just iOS no? Or does that work on MacOS too

Comment by flohofwoe 5 days ago

It works on macOS too, I don't own any iOS devices.

Comment by Hamuko 6 days ago

Same. It's not the worst thing in the world, at least with Reduce Transparency enabled in the Accessibility settings, but I still don't feel any inclination to upgrade. My personal Mac Studio is macOS 15 and my work MacBook is on macOS 26, and I don't think there's a single thing that I find to be better on the work laptop than on my personal machine.

I might update to macOS 26 in September to be ready to update to macOS 27. Being two versions behind doesn't seem reasonable and I'd rather be on the "Tahoe but less shitty" version than Tahoe itself.

Comment by coldpie 6 days ago

I found if you turn off transparency effects and turn on high contrast in the accessibility settings, it's actually a pretty nice looking UI. Still has some dumb quirks like inconsistent corner radiuses and text appearing under UI elements (because they're assumed to be transparent, but aren't). But all software is trash in 2026 so be thankful it isn't even worse, I guess.

Comment by Melatonic 5 days ago

Been doing that for years now already (performance boost). You can also do high contrast mode per app (if were talking about iOS). Must have for iMessage I think personally as it makes hard to read Green Bubbles a nice dark green that is very pleasant.

Comment by pmdr 6 days ago

I bought a MBP mainly for the hardware, otherwise I'd have stuck with Linux. OS-wise, the jump from Monterey (which I'd last used) to Sequoia was smooth and still feels that way. I prefer not to notice the OS at all, something that I feel would be hard to do on Tahoe due to all that liquid glass and dumb transparency and animations.

Seriously, who the heck even asked for those?

Comment by IdiotSavage 6 days ago

I hate the round corners. It's already too much on 15, but way worse on 26. It looks like "Baby's first OS", designed by Fisher-Price.

Comment by hbn 6 days ago

They reverted this in 27

https://www.macrumors.com/2026/06/09/macos-golden-gate-liqui...

Comment by ak217 6 days ago

Love to see this, now if only they could revert the whole shimmering oil slick disaster that is "glass" on iOS (unlike macOS, even if I "reduce transparency", the oil slick effect still appears in many places, in addition to all the spacing issues).

Comment by frizlab 6 days ago

macOS 27 does polish Liquid Glass and makes it look passable on macOS IMHO. It was very bad on 26. Comically bad.

Comment by reddalo 6 days ago

That's the sad thing: Apple decided to leave all Intel macs on broken macOS 26. Very bad on Apple's part.

Comment by coatmatter 5 days ago

I believe this is the definitive resource on the state of Linux on Intel MacBook Pros: https://github.com/Dunedan/mbp-2016-linux

I recently made the move away from an out-of-support macOS 12 Monterey to Debian Stable (13 trixie), after some failed attempts to upgrade macOS using OpenCore Legacy Patcher.

While Linux support will always remain far from perfect with that series of MBP, it was still much better than I expected compared to my last look many years ago. I happen to get better use out of my particular setup now compared to macOS; as it's basically a glorified streaming device that I interact with through wayvnc/vncviewer out of arm's reach across a table. This also allows me to mostly avoid using the semi-busted Butterfly keyboard.

In addition to having something with security updates again, I'll now never need to think about Apple dropping Intel support. I'd also like to note that nix-darwin support on Intel macOS is ending very soon too - but not Linux + nix as a package manager (nixpkgs) since that combination is separate to macOS + nix-darwin.

Comment by drnick1 6 days ago

Fortunately, those can run Linux. I recently installed Arch on an Intel T2. The only issue is that it does not have a TPM module, so the LUKS password needs to be manually entered at boot.

Comment by normie3000 5 days ago

What's the alternative to typing in a LUKS password?

Comment by cyberax 5 days ago

You can use TPM with secure boot to store the password. TPM checks that the firmware is the same and that the OS is signed by trusted (by _you_) keys, and if everything matches it makes the key available for reading by the OS.

Comment by normie3000 4 days ago

So what stops other people turning on your computer?

Comment by shepherdjerred 6 days ago

27 is a lot better. You can make the UI opaque again (they provide a transparency slider)

Comment by simlevesque 6 days ago

You can disable it in the accessibility preferences.

Comment by embedding-shape 6 days ago

Same thing happens almost every release. I've stopped updating my Mac machine until I see something in the release notes I literally have to have in order to continue doing macOS/iOS builds, otherwise I'm staying on the version I've validated to work, and I know the existing bugs with.

Comment by GeekyBear 5 days ago

As we used to say in the Windows world, wait for service pack 3.

Comment by pjmlp 5 days ago

That doesn't work any longer given patch tuesdays, at work wait that IT validates them and pushes the updates via managed WSU, at home, it is worthwhile wanting if something hits the news on WindowsCentral, Verge or what have you.

Comment by GeekyBear 5 days ago

It doesn't work with Windows anymore, since Microsoft no longer allows the user to control their own computer.

However, Software Update on Apple devices still allows you to turn off automatic update installation the way Windows used to.

Comment by pjmlp 5 days ago

It does when using Professional and Workstation, there are still a few knobs available.

For quite some time that I don't use home edition.

I also would not bet on Apple staying that way.

Comment by GeekyBear 4 days ago

"You can delay this update for a little while" simply isn't the same thing as "you still have full control over updates".

It's right up there with Microsoft's "you are not allowed to turn telemetry all the way off", or all the efforts to require the use of an online Microsoft account to access your own computer.

Comment by pjmlp 4 days ago

You mean the efforts to follow Apple and Google footsteps and stores?

Ever heard of Local Group Policy Editor?

Comment by GeekyBear 4 days ago

WindowsRT and Windows S were already attempts to lock down Windows to only allow apps from an app store.

Secure Boot initially didn't allow the install of operating systems other than Windows.

Microsoft is the company continually attempting to lock down their general purpose computers, not Apple.

...and no. Microsoft backing down aftet consumers revolt doesn't mean their attempts don't count.

Comment by pjmlp 3 days ago

Right, because Apple anyway never allowed anyone else, other than when they were almost bankrupt, went into a marketing action to pretend otherwise, now back to their former self as well with a nice bank account.

Comment by DavideNL 6 days ago

A better strategy would probably be to stick with the previous *major* release, but, do install its ("minor") security updates...

Comment by embedding-shape 6 days ago

> do install its ("minor") security updates

Yeah, I thought so too, but surprise surprise; some months ago one of the "minor" updates "broke" ("upgraded") something that made my CI/CD setup stop working, that's when I dropped the idea that Apple even do "minor" updates anymore.

Comment by bouke 6 days ago

The question now is, is 27 sufficient enough of an improvement over 15 to upgrade and tolerate Liquid Glass?

Comment by reddalo 6 days ago

>have led many people to defer upgrading until MacOS 27 is available

Then there's me, crying in MacBook Pro 2019 stuck on MacOS 15 because 27 won't be available for my machine.

Comment by ExoticPearTree 6 days ago

26.0 had a very annoying video jitter issue, but that was the first things that I noticed to be fixed in the next 26 release. Other than that, it worked just fine.

Comment by andreasley 6 days ago

The bug that led to network connection issues after 49 days of uninterrupted uptime was a bit of a showstopper for me.

Comment by carra 6 days ago

Are there no versions between MacOS 15 and 26???

Comment by kylemaxwell 6 days ago

They changed the numbering scheme, so... no, there aren't. Version numbers are now year-based, but previously they were not.

Comment by hbn 6 days ago

Last year they unified all their OS version numbers to just match upcoming year.

macOS went from 15 to 26

iOS went from 18 to 26

watchOS went from 11 to 26

and so on

Comment by classified 6 days ago

No, 26 is the successor of 15. They changed the numbering to year-based.

Comment by 6 days ago

Comment by gokohl 6 days ago

[dead]

Comment by crossroadsguy 6 days ago

Did they un-hardcode the corner radius? I mean were they able to? I mean not that that anyone at this point needs convincing how utterly disgusting incompetent they’re at software.

Comment by gedy 6 days ago

They reduced the radius back to older, smaller size and now all apps use a single radius, vs the weird 3 different radii in Tahoe. Looks better.

Comment by hbn 6 days ago

I was shocked to find out the inconsistent corner radii in Tahoe was an intentional design decision. I figured it's so obviously bad that it was just sloppy work. But one of the WWDC session videos bafflingly clarified that it depends on whether the app has a toolbar or not.

https://youtu.be/VqTn9NgiE1s?t=439

I can't imagine how the people who signed off on that were put in charge of design at Apple.

Comment by gedy 6 days ago

I am fairly convinced this was all designed only in graphic tools, and looked nice in static mockups, like those fake desktops with overlapping small windows widely spaced, etc. The design folks probably all had giant studio displays with plenty of room, etc.

Then the reality of "what about toolbars", "what about dark mode", "what about laptop screens", etc were all afterthoughts and resulted in bolt-on fixes like that.

Comment by pjmlp 6 days ago

Map the amount of fixes with "... improved bounds checking...", "...improved memory handling...", "...improved memory management..." into the amount of developer, QA and release management teams salaries per hour, versus other stuff they could be working on, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.

Comment by bluecalm 6 days ago

>>, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.

You need also factor development time and ease of finding developers willing to work in a specific language. There are other factors like readability of the code (very verbose languages are likely to be worse) and cost of maintenance - languages forcing a lot of abstractions are likely much worse.

Comment by acdha 6 days ago

> You need also factor development time and ease of finding developers willing to work in a specific language

This even more strongly favors Rust or Swift. Nobody is writing C or even Objective-C in 2026 as a growth language.

Comment by zbentley 6 days ago

If you just meant apple-targeting developers, then yeah; you're right that those languages are in decline. But if you meant developers in general, I think you'd be surprised how many growth sectors are hiring C programmers. They're often not SaaS tech companies, but they are massive and many are growing. Hardware, industrial control systems, defense/aerospace ... there's a ton there, the spaces in which they hire just don't overlap a ton with the spaces frequented by hacker news. Also, a lot of them aren't US based companies.

I hope that changes over time, since I definitely agree that the downsides of C-family languages massively outweigh the downsides of competitor languages.

Comment by pjmlp 6 days ago

Which is why WG14 and WG21 caring about security would be quite relevant, but alas, priorities.

C could have gotten slices already in the 90's, the concept already existed in other languages, and even Dennis Ritchie made a fat pointer proposal into that sense.

The others, let see if anything related to profiles actually gets into C++29.

Comment by acdha 6 days ago

[dead]

Comment by zbentley 6 days ago

> very verbose languages are likely to be worse

Citation needed. I don't think there's a correlation there. Over-architected Java spaghetti is verbose and unmaintainable. Under-architected Perl code golf that metastisized is terse and unmaintainable.

> languages forcing a lot of abstractions are likely much worse

Citation needed. C++ has had some very high-level abstractions on top of a low-level runtime for awhile, and plenty of people have decided to use it and hire for it regardless. What counts as an "abstraction" or "forced abstraction" is a very very subjective topic.

Comment by pjmlp 6 days ago

Even C can be super abstracted, see early 1980-90's business software written in C, with nice stuff like Yourdon Structured Method, leading to over-architected C spaghetti with macros, a decade before Java came to be.

The problem is the lack of interest since Morris worm came to be, to provide better mechanisms in said languages, until governments and key big tech names decided it was time to change existing practices.

Comment by snvzz 6 days ago

If anything, there's a strong argument to switch to seL4.

Comment by yjftsjthsd-h 6 days ago

It was my vague understanding that by the time you implemented all the apis needed to run normal software on top of that, you either have enough apis that different tasks can still compromise each other, or you have shoved everything into a single task with very little isolation between normal user processes. In either case, it doesn't seem like you actually gained so much. What am I missing?

Comment by pjmlp 6 days ago

Indeed, however without some regulatory help it Will take its time for such kind of improvements across the industry.

Comment by 6 days ago

Comment by UqWBcuFx6NV4r 6 days ago

“nah bro, all those other developers are just garbage, I am the one person that can write memory safe C”

Comment by 6 days ago

Comment by embedding-shape 6 days ago

Lots of "in collaboration with Claude and Anthropic Research" mentions, no mentions of other labs. I'd assume Apple already had access to whatever the most powerful model is at the various US-based labs, but perhaps not?

Comment by woadwarrior01 6 days ago

Those were voluntary disclosures by two Anthropic researchers and the security firm Calif. I know one more CVE on the list that was discovered using an AI agent and wasn't disclosed as such. I suspect there are many more.

Comment by tombot 6 days ago

Apple isn’t friends with OpenAI anymore

Comment by muterad_murilax 6 days ago

What happened?

Comment by mrtksn 6 days ago

The gist is, OpenAI hired a high ranking Apple employee who helped other Apple employees get hired by OpenAI and exfiltrate Apple trade secrets in the process.

Allegedly of course.

Comment by makeitdouble 6 days ago

> high ranking Apple employee

Jony Ive basically works for Open AI (it's more complicated, but it's a good approximation), and has more or less rebuilt a designing team over there.

He's not the central person mentioned in Apple's accusations but that's arguably the central point that's triggering all of this.

Comment by ajmurmann 6 days ago

Didn't he live Apple a very long time ago?

Comment by danso 6 days ago

Yes, the high ranking employee at the center of the accusations is not Ive, but Tang Tan, former VP of product design

https://www.bbc.com/news/articles/cy8w379e091o

Comment by alwillis 6 days ago

He left in 2019 and formed his own company, that did design work for Apple until 2022.

He "took" several Apple employees with him when he left and there's been a steady stream of Apple employees going to OpenAI.

Ive isn’t responsible for all of them obviously, but the articles about lawsuits says there are 400 former Apple employees at OpenAI.

Comment by SoftTalker 6 days ago

Sounds like Apple needs to do a better job at being a place where employees want to stay.

Comment by acdha 5 days ago

Given that his departure was marked by Apple products getting more reliable and usable, they arguably did too much in that regard (one of Cook’s more notable bad calls). Once he stopped blocking it, the keyboards were fixed and pro devices regained enough ports for pro users.

Without his support, his protege Alan Dye left for Meta and improved the design skills at both companies.

Comment by manmal 5 days ago

Or, good that the craze for ever thinner laptops has been slowed?

Comment by MBCook 6 days ago

A lot more than several. Sounded like it ended up being a large chunk of his team.

Comment by anonymars 6 days ago

The accusations are pretty wild

https://news.ycombinator.com/item?id=48865294

Comment by lapcat 6 days ago

> Lots of "in collaboration with Claude and Anthropic Research" mentions

I wouldn't say 4 is lots. The entire list is massive. I haven't counted myself, but someone claimed that macOS 26.6 has the all-time record with 155 CVEs.

Comment by embedding-shape 6 days ago

Considering that in Feb 2026 (https://support.apple.com/en-us/126348) Claude wasn't mentioned even once, 4 sure sounds like "lots" compared to nothing :) But you're right, it's subjective ultimately.

Comment by senadir 6 days ago

Apple also hosts a copy of Claude internally in their servers.

Comment by cromka 6 days ago

Do they? As in Claude but on premises? Wonder if this is gonna be the solution that e.g. banks will require, exactly like they do now for cloud services (e.g. Azure on premises).

Comment by Cider9986 6 days ago

Banks are all about security theatre so probably not.

Comment by pbronez 6 days ago

Pretty extreme solution… you can get Claude models from AWS Bedrock and Google Model Zoo. These are both very helpful for compliance and security, but do require you to have a cloud strategy.

Comment by ainch 6 days ago

Some data is so sensitive it likely has to stay on premises though.

Comment by cromka 6 days ago

That's why banks use Azure on Premises (not sure if other providers offer the same, but the investment bank I worked at did)

Comment by UqWBcuFx6NV4r 6 days ago

Yeah, albeit an increasingly second-rate experience, at least when it comes to Bedrock.

Comment by bel8 6 days ago

source?

edit: it seems asking for a source it frowned uppon in this site. And it seems there's no source.

Comment by mholm 6 days ago

I don't believe it's published anywhere, but it's common knowledge to Apple engineers. I can second the poster's assertion that they run Claude internally.

Comment by MBCook 6 days ago

I know they use it, they host it too?

That would be a very Apple thing to do.

Comment by bel8 6 days ago

Yeah that's why I asked. It would be one thing to use, another to host.

And it seems nobody has a source so it's just humors as usual.

Comment by mholm 6 days ago

Yes, they host it on their own infrastructure.

Comment by MBCook 6 days ago

Makes sense. I’m sure they have no interest in every Claude prompt going to Anthropic to keep eyes on what Apple is up to.

Comment by alwillis 6 days ago

> That would be a very Apple thing to do.

That's something Steve Jobs would have done.

Comment by MBCook 6 days ago

I don’t know about hosting it internally but a an Apple focused podcast I listen to (Accidental Tech Podcast) has mentioned numerous times in the last few months they’re using Claude heavily. And they know Apple insiders.

Comment by claiir 6 days ago

also “ Using GLM From Z.AI”

Comment by AJRF 6 days ago

Weird thing to see at number 3 on HN - is there some subtle context I am missing here?

Are we wink winking that it's a lot of fixes?

Comment by microtonal 6 days ago

It is a lot of fixes and the Android Security Bulletins of June and Android 17 also had a lot of fixes [1], despite ASBs only containing high/critical vulnerabilities (other vulnerabilities are only fixed in major releases and QPRs, which most Android vendors respectively roll out late or never at all).

I think the story here is that vulnerability discovery has accelerated a lot with LLMs, but since are adversaries are doing the same, it is more important than ever to update quickly (and not let some Android vendors get away with their lazy update schedules).

[1] https://source.android.com/docs/security/bulletin/2026/2026-... https://source.android.com/docs/security/bulletin/android-17

Comment by cubefox 6 days ago

So using newish phones that don't get updated anymore could be a lot more dangerous now than it was just a year ago.

Comment by acdha 6 days ago

Right - it was always dangerous but people who figured they weren’t important enough to be attacked might find out that LLMs have shifted that cost in the wrong direction.

Comment by cubefox 5 days ago

That sucks.

Comment by grahamlee 6 days ago

And it's not actually that much information "about the security content". For example: "Impact: An app may be able to access sensitive user data. Description: An access issue was addressed with additional sandbox restrictions." This references CVE-2026-43819, which doesn't have any more information. Compare this with the nearly decade-old https://support.apple.com/en-gb/103680, and you see much more specific information about problems and their remedies (except in situations where Apple's action was to update a vendor component).

Comment by Gigachad 6 days ago

The vagueness could be intentional. There’s been a big issue with linux where proof of concept exploit code gets posted before the bug is announced because people reverse engineer it from the fix commits.

Apple has the advantage that they can keep everything secret for long enough for the patches to roll out. And realistically there is no reason the user needs to know the details of an exploit that was patched before it was ever used.

Comment by eviks 5 days ago

> before it was ever used.

But since this is never known, does the user need to know?

Comment by acdha 5 days ago

Remember that they have a great deal of telemetry around things like crashes and work with groups like Citizen Lab for certain high-risk users. You can’t prove that something was never used in a perfectly targeted and concealed attack but it’s likely they can say it wasn’t used outside of such contexts, and once you’re at the level of things like “the Mossad deployed an exploit after configuring the local cell tower to drop external network access before crash reporter could phone home” user notifications in the release notes aren’t effective anyway.

Comment by DStiego 6 days ago

Relevant context might be for example that there are 4 mentions each of Claude by Anthropic and XGPT by ThreatBook, both based on LLMs.

AI attribution might be one reason people are particularly curious.

Comment by AJRF 6 days ago

I missed that, thanks for pointing out

Comment by cromka 6 days ago

I think it's because it's the first big batch of fixes found at Apple by Mythos.

Comment by nozzlegear 6 days ago

Is this speculation? Where does it say Mythos was responsible for any of this?

Comment by cromka 6 days ago

It is speculation, which is what I think the upvote count reflects.

Comment by Tepix 6 days ago

Yes, it's really quite a lot https://9to5mac.com/2026/07/27/ios-26-6-fixes-over-75-securi...

Comment by croemer 6 days ago

I think that's it?

Comment by TheJoeMan 6 days ago

This may be a naive take, so if anyone has insight please feel free to share, but across Windows, Mac, and Linux OS's I see many cases of path parsing vulnerabilities resulting in sandbox escapes, code execution, or data access issues. When presenting the user with a file picker or command-line input, is it really needed that the software can handle the full POSIX spec?

I do not see a "typical" user needing to access a path with say a network storage but multiple ../.. and hard and soft symlinks simultaneously. I think "be liberal in what you accept" might need to be revisited for path parsing with some sort of OS-wide single-implementation as an optional feature.

Comment by acuozzo 6 days ago

> I do not see a "typical" user needing to access a path with say...

Typical users run software written by atypical users.

> some sort of OS-wide single-implementation

How do you propose handling migration? What if someone tries to expand an old archive file containing a now-forbidden path?

Comment by TheJoeMan 6 days ago

What I mean is that for “honest” software, built-in to the OS or otherwise, the programmer finds a situation where they take some user-supplied input and concatenate that into a path, and call something like OS.read(). If they want to prevent the user from causing havoc, they now find themselves dealing with path validation in their software instead of calling OS.safeOpen(), which would be a reduced subset of allowed chars?

Comment by SoftTalker 6 days ago

If the OS is working properly, the havoc should just result in "permission denied."

If there's a path on the system that the user should not be able to read, that's the job of the OS to handle, not the individual applications.

Comment by eviks 5 days ago

How is it permission denied if the app is running as admin? The OS "handled" it by giving admin app admin access. Sure, it was tricked by the user input, but that's what the fixes are for?

Comment by catlifeonmars 6 days ago

How would you enforce a single implementation of path parsing?

Comment by nizbit 6 days ago

Collision counts are absurd. CVE-2026-43739 has roughly twenty credited researchers; CVE-2026-43816 has nearly as many. And ai attribution getting credit.

Comment by croemer 6 days ago

One CVE even lists the same person twice!

CVE-2026-64691: Ruslan Dautov, Ruslan Dautov

Comment by Someone 6 days ago

> One CVE even lists the same person twice!

Not necessarily. Could be two persons sharing that name. See https://revstat.ine.pt/index.php/REVSTAT/article/view/382

Comment by ayewo 5 days ago

How did you unearth such a remarkable find of 2 different faculty individuals named "Philipp Otto" collaborating on the same paper :) ?

Comment by proactivesvcs 6 days ago

One of them lists an anonymous person!

CVE-2026-43744: Mathis Mansière, an anonymous researcher

Comment by nkrisc 6 days ago

It reads as if "an anonymous researcher" is describing Mathis Mansière, which is quite humorous.

Comment by rubslopes 6 days ago

This reminds me of my favorite segment of the TV show Curb Your Enthusiasm: https://youtu.be/JqrJ4wGid4Y

Comment by darkwater 6 days ago

Spell checker fixed a typo, it was originally "an Anonymous researcher" /s

Comment by receiptful-io 6 days ago

Genius, that made my day!

Comment by conradfr 6 days ago

It's Ted Danson.

Comment by FabHK 6 days ago

Apropos, anyone else saw "fast user switching" in Tahoe turn into "excruciatingly slow user switching which after a minute of switching without success rebooted the whole damn machine"?

Comment by BoardsOfCanada 6 days ago

It would be so nice to see how many zero-days are going away for bad players right now.