Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

support.apple.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#31

Post by atonse »

jshier wrote: post #25
dragonsenseiguy wrote: post #24

Sidenote but: it's crazy how big this update is. 13 GB is crazy

Update from 26.3 to 26.4 for the Studio Display XDR was 2.4GB. And that's for a variant of iOS designed for screens.

Yeah I’m honestly not sure why macOS updates seem to be so huge. Often gigabytes. Do they actually have thousands of changes, so they basically ship out new versions of almost all system libraries? Or is it that they don’t have good diffing in place? Or is it a BSD thing where you basically ship everyone at once since it’s all sort of “one version” of the base system?

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#32

Post by Marsymars »

mort96 wrote: post #29
vessenes wrote: post #9

For many years my go-to plan has been to stay one point release behind apple's releases, especially the .0 releases -- but, times change. Last night I pushed the button for 26.5, thinking about the Glasswing/Mythos reporting. Seems like staying on bleeding edge is going to be the name of the game. I wonder if this will change general dynamics -- feels like LTS releases could become even more important, at the same ti…

Staying one point release behind is weird isn’t it? I get staying a major release behind, Apple’s x.0 releases are often pretty rough so it might be worth staying on x-1 for a while. But point releases mostly just fix the stuff they broke in the major release.. Would you really upgrade from 18.5 or whatever to 26.0 when Apple releases 26.1?

Point releases for macOS can be pretty large over the past several years - what often makes sense is waiting a few weeks to upgrade in case there's a .1 patch.

e.g. macOS 15.0, 15.1, 15.3, 15.4, 15.6 and 15.7 all had .1 patches within a few weeks of release.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#33

Post by tom_ »

Aurornis wrote: post #13

More than 26.5: > The affected releases include iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. I’ve already seen a lot of people self-congratulating for not updating to Tahoe but this isn’t exclusive to Tahoe.

> The affected releases include iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.

Where does this quote come from? I can't see it in https://support.apple.com/en-us/127115, the article link at time of writing. It mentions CVE-2026-28952, but we're forced to guess why. I'd take the reference to mean that this issue is fixed, but I'm just some internet rando, so what the hell do I know?

If I do a google search for "CVE-2026-28952", it points me to various pages. Here's one, for example: https://www.cve.org/CVERecord?id=CVE-2026-28952 - which is a bit more explicit, though of course this is not from the horse's mouth:

> This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#34

Post by cryptbe »

Oh hey, this is our work! We helped Anthropic analyze and report this bug.

For the record, this bug has nothing to do with our recent MIE attack [1] [2], which exploited two different kernel bugs. Our bugs are not fixed yet.

[1] https://blog.calif.io/p/first-public-kernel-memory-corruptio...

[2] https://news.ycombinator.com/item?id=48139219

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#35

Post by xyzzy123 »

JCattheATM wrote: post #30
concinds wrote: post #22

I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…

I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#36

Post by jeffbee »

fl1pper wrote: post #6

Where all of this is going? Will there be a dedicated servers running coding agents that iterate throught codebases for each company to find vulnerabilities 24/7?

Why shouldn't there be such things? We already have fuzzing, and responsible software publishers dedicate 24/7 resources to fuzzing.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#37

Post by JCattheATM »

xyzzy123 wrote: post #35
JCattheATM wrote: post #30

Earlier quoted context omitted.

I'd guess they haven't even begun to really utilize them. They've never been a terribly security conscious company, despite the marketing.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, for example.

They've improved a lot, especially their phones, but I'd still never consider them a company that has a really strong focus on security.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#38

Post by maximilianburke »

I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device!

It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#39

Post by alwillis »

atonse wrote: post #31
jshier wrote: post #25

Earlier quoted context omitted.

Update from 26.3 to 26.4 for the Studio Display XDR was 2.4GB. And that's for a variant of iOS designed for screens.

Yeah I’m honestly not sure why macOS updates seem to be so huge. Often gigabytes. Do they actually have thousands of changes, so they basically ship out new versions of almost all system libraries? Or is it that they don’t have good diffing in place? Or is it a BSD thing where you basically ship everyone at once since it’s all sort of “one version” of the base system?

> Yeah I’m honestly not sure why macOS updates seem to be so huge.

An update to macOS 26.5 contains all the necessary code to update a Mac from 26.0 to 26.5 for both x86_64 and arm64 architectures.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#40

Post by xyzzy123 »

JCattheATM wrote: post #37
xyzzy123 wrote: post #35

Earlier quoted context omitted.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

Agree that pre Apple Silicon, macOS didn't get much focus. Fair point historically.
Post reply on HN