CISA added an Apple Pointer Authentication bypass, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog on November 4, 2026. The flaw was patched in May 2024, but Sekoia says a suspected Russian state group used it in watering-hole attacks that steal data from unpatched iPhones. Anyone running an older iOS version should check their update status now.
What happened
CVE-2024-27834 is rated medium (CVSS 5.5). It is an authentication weakness that lets an attacker who already has arbitrary memory read and write access bypass Pointer Authentication (PAC), a protection that makes it harder to hijack code execution. Apple fixed it with improved checks in iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. It was first shown as a zero-day at Pwn2Own Vancouver in March 2024.
Security firm Sekoia published research on November 4 describing watering-hole campaigns that chained browser bugs with the PAC bypass, with no user interaction beyond visiting a page. Sekoia assesses with moderate to high confidence that APT29, also tracked as Midnight Blizzard or Cozy Bear, is behind it. The Hacker News and Security Affairs report that victims reached the malicious code through compromised sites, lookalike sites, and a supply-chain compromise of the Plerdy SEO Tracker. Ostorlab, which analyzed the Sekoia report, says the injected loader was served from August 27 to September 3, 2026, and that most sites loading the Plerdy script were Ukrainian. Those Plerdy details come from Ostorlab and have not been independently confirmed by us.
Reports say the payload steals browser cookies and device data. Ostorlab describes three exploit chains, one of which, aimed at newer iPhones, also harvests messages, mail, Keychain data and photos. CISA set a November 18, 2026 deadline for federal civilian agencies to apply fixes.
Who is affected
Devices that have not been updated in a long time are the target. According to Ostorlab, the oldest chain hits iOS 16.0 to 16.7.7 and 17.0 to 17.4, while a second chain targets iOS 18.x before 18.7.3 and iOS 26 before 26.3. Ostorlab also lists an Android chain against Chrome 139 to 145 on devices with an unpatched Qualcomm Adreno driver. Ostorlab notes that the 16.7.8 and 17.5 updates fix the PAC bypass but not a separate WebKit flaw, CVE-2025-43529, which Apple fixed only in iOS 18.7.3 and 26.2. So the older updates alone may not close the whole chain.
What to do
- Update iPhones and iPads to the newest iOS or iPadOS your model supports. Ostorlab recommends 26.3 where possible, and at least 18.7.3.
- Update Chrome to 146.0.7680.75 or later on Android and install your phone maker’s latest security update.
- Our analysis: if a device that could not be updated visited unfamiliar or Ukrainian-linked sites in late August or early September, consider rotating passwords and signing out of active sessions, since cookies were a stated target.
- Our analysis: retire devices that can no longer receive updates, and site owners should check whether they load the Plerdy tracker and remove any injected snippet.
What we still do not know
Sekoia has not released its full indicators of compromise, according to Ostorlab. The number of victims is not public, and the Hacker News listing of exploit-chain CVEs appears inconsistent, so we relied on Ostorlab for the CVE mapping. CISA has not attributed the attacks to any group; the APT29 link is Sekoia’s assessment, not a confirmed finding. Apple has not, as far as we found, said whether older iPhones will get further fixes.
Sources: The Hacker News, “Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says” (Nov. 5, 2026) – link; Security Affairs, “U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog” (Nov. 5, 2026) – link; Ostorlab, “APT29 Watering Holes Exploit Mobile n-Days” (Nov. 5, 2026) – link.
Leave a Reply