Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

support.apple.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#41

Post by baq »

samtheprogram wrote: post #26
vessenes wrote: post #9

For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game. I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same ti…

Security updates still go out for older major releases back 2 versions. You didn’t need to jump to 26 if you weren’t on it.

Tell that to my IT department please

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#42

Post by guessmyname »

concinds wrote: post #22

I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s no benefit to talk about it other than to satiate people’s curiosity about what we do or don’t do internally.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#44

Post by AnthonyMouse »

xyzzy123 wrote: post #35
JCattheATM wrote: post #30

Earlier quoted context omitted.

I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

> I guess because Apple control the stack from silicon to userspace.

People always say this but there is no real relationship there. When hardware vendors add security technologies to the hardware, the major third party operating systems add support to use it pretty much immediately, and in many cases before the hardware even ships because the hardware vendor publishes the documentation ahead of time.

Try to name something where Apple was the first to support something (by a non-trivial amount of time) not because they were the first to add hardware support but because they released the combination of hardware and software in the time between when e.g. Intel or Qualcomm added hardware support and when Linux or Windows added software support to use it.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#45

Post by KennyBlanken »

JCattheATM wrote: post #37
xyzzy123 wrote: post #35

Earlier quoted context omitted.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years.

That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux distros started moving to a similar model.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#46

Post by zx8080 »

maximilianburke wrote: post #38

I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device! It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.

I thought one just get a new iphone when run out of storage.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#47

Post by tptacek »

firesteelrain wrote: post #28
three_burgers wrote: post #18

CVE-2026-28952 is about an integer overflow due to lack of input validation. I wonder what makes such vulnerability difficult to discover by traditional SAST tools?

Fuzzing, dynamic analysis or DAST might have found it too. Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

Then why didn't they?

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#48

Post by jonhohle »

KennyBlanken wrote: post #45
JCattheATM wrote: post #37

Earlier quoted context omitted.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years. That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux…

Didn’t Microsoft pioneer the privilege escalation prompts in Vista in 2007? It was a joke at the time how little things would hijack the entire screen to allow seemingly mundane things. I didn’t ever use Vista personally or professionally, but macOS has become pretty bad with basically the same model.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#49

Post by jonhohle »

maximilianburke wrote: post #38

I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device! It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.

You can do a tethered update and get a local backup at the same time.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#50

Post by nprateem »

guessmyname wrote: post #42
concinds wrote: post #22

I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s…

[flagged]
Post reply on HN