Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

support.apple.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#101

Post by tptacek »

firesteelrain wrote: post #98
tptacek wrote: post #95

Earlier quoted context omitted.

Which tool specifically are you thinking of that might have found this but wasn't run because of it's very high licensing fees? I work in this field, I'll be familiar with it.

Black Duck products https://www.blackduck.com/fuzz-testing.html OpenText products https://www.opentext.com/products/dynamic-application-securi... I won’t say how much they are here but they are very expensive.

Just to be clear: your claim is that the Black Duck fuzzer would have enabled the rapid discovery of kernel vulnerabilities in macOS?

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#102

Post by firesteelrain »

tptacek wrote: post #101
firesteelrain wrote: post #98

Earlier quoted context omitted.

Black Duck products https://www.blackduck.com/fuzz-testing.html OpenText products https://www.opentext.com/products/dynamic-application-securi... I won’t say how much they are here but they are very expensive.

Just to be clear: your claim is that the Black Duck fuzzer would have enabled the rapid discovery of kernel vulnerabilities in macOS?

Question was about high licensing fees and which tools I was referring to

I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons

My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#103

Post by tptacek »

firesteelrain wrote: post #102
tptacek wrote: post #101

Earlier quoted context omitted.

Just to be clear: your claim is that the Black Duck fuzzer would have enabled the rapid discovery of kernel vulnerabilities in macOS?

Question was about high licensing fees and which tools I was referring to I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs

We might just be talking past each other. My question, from upthread, is this: the heyday of AFL was over a decade ago. Every major platform company fuzzes at a scale that I think is difficult for lay practitioners to get their heads around. They contract, quarterly, soup-to-nuts assessments from competing software security companies, who get full source access and are measured against each other by the quality of their findings. They run bounty programs specifically to direct public researcher attention to these exact findings.

Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic!

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#104

Post by curt15 »

KennyBlanken wrote: post #45
JCattheATM wrote: post #37

Earlier quoted context omitted.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years. That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux…

> That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux distros started moving to a similar model.

Linux distros have always required sudo for "dangerous" things. What distros made users root by default?

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#105

Post by JCattheATM »

pjmlp wrote: post #85
JCattheATM wrote: post #37

Earlier quoted context omitted.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

I am PC, I am Mac campaign is from 2006, quite long time ago.

Sure, I think I gave it that context by using the term historical.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#106

Post by JCattheATM »

dwaite wrote: post #79
JCattheATM wrote: post #37

Earlier quoted context omitted.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

Windows and macOS both got ASLR in 2007. For another example: macOS integrated antivirus in 2009, while Windows did so in 2012.

Apple's ASLR was incomplete and basically trash for a long time, it didn't get proper ASLR until much later.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#107

Post by akerl_ »

firesteelrain wrote: post #100
akerl_ wrote: post #96

Earlier quoted context omitted.

Apple has a massive information security organization that has pretty intense resources at their disposal. It seems borderline impossible that there's a tool that they feel would be beneficial but that they're classed out of using by license costs or by staff proficiency.

It happens at a lot of places that the budget isn’t unlimited when it comes to information security. But even then it comes down to risk management.

We’re in a thread about an Apple vulnerability, where the claim was made that they’d have found these if they’d properly run traditional tooling.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#108

Post by firesteelrain »

tptacek wrote: post #103
firesteelrain wrote: post #102

Earlier quoted context omitted.

Question was about high licensing fees and which tools I was referring to I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs

We might just be talking past each other. My question, from upthread, is this: the heyday of AFL was over a decade ago. Every major platform company fuzzes at a scale that I think is difficult for lay practitioners to get their heads around. They contract, quarterly, soup-to-nuts assessments from competing software security companies, who get full source access and are measured against each other by the quality of th…

> Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic!

Because they simply aren’t ran. That’s my entire argument

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#109

Post by tptacek »

firesteelrain wrote: post #108
tptacek wrote: post #103

Earlier quoted context omitted.

We might just be talking past each other. My question, from upthread, is this: the heyday of AFL was over a decade ago. Every major platform company fuzzes at a scale that I think is difficult for lay practitioners to get their heads around. They contract, quarterly, soup-to-nuts assessments from competing software security companies, who get full source access and are measured against each other by the quality of th…

> Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic! Because they simply aren’t ran. That’s my entire argument

You're wrong about that.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#110

Post by firesteelrain »

tptacek wrote: post #109
firesteelrain wrote: post #108

Earlier quoted context omitted.

> Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic! Because they simply aren’t ran. That’s my entire argument

You're wrong about that.

How? If the tools were ran the same findings may have occurred.
Post reply on HN