This isn't a 26.5 bug, this is a bug fixed in 26.5.
CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
21–30 of 124 posts
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#22I wonder how well Apple has deployed these tools internally for security research.
Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has deployed this tooling as much as Google.
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#23This isn't a 26.5 bug, this is a bug fixed in 26.5.
Ah my bad for the wrong wording.
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#24Sidenote but: it's crazy how big this update is. 13 GB is crazy
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#25Sidenote but: it's crazy how big this update is. 13 GB is crazy
Update from 26.3 to 26.4 for the Studio Display XDR was 2.4GB. And that's for a variant of iOS designed for screens.
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#26For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game. I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same ti…
Security updates still go out for older major releases back 2 versions. You didn’t need to jump to 26 if you weren’t on it.
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#27For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game. I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same ti…
Same! I almost never updated, now I feel like i need to update. Kinda feels like FOMO but for security updates
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#28CVE-2026-28952 is about an integer overflow due to lack of input validation. I wonder what makes such vulnerability difficult to discover by traditional SAST tools?
Fuzzing, dynamic analysis or DAST might have found it too.
Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#29For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game. I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same ti…
Staying one point release behind is weird isn’t it? I get staying a major release behind, Apple’s x.0 releases are often pretty rough so it might be worth staying on x-1 for a while. But point releases mostly just fix the stuff they broke in the major release.. Would you really upgrade from 18.5 or whatever to 26.0 when Apple releases 26.1?
Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude
#30I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…
I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.