Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

support.apple.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#71

Post by xyzzy123 »

KennyBlanken wrote: post #52
xyzzy123 wrote: post #40

Earlier quoted context omitted.

Agree that pre Apple Silicon, macOS didn't get much focus. Fair point historically.

That's a really strange claim given AS was a refinement of a technology other manufacturers have yet to surpass in the ten years since the T1 chip came out. To this day nobody else ties their SMC, biometric auth, and HSM together as tightly and well as the T1 did. AS was further advancement of that. Furthermore, Apple protects users against the legal changes that have allowed law enforcement to physically force someo…

iOS always had a strong focus on security but if you take the time period say 2005 - 2015 it did not seem like there was much investment in macOS security at Apple. I am talking about stuff like exploit mitigations and relatively low hanging LPEs. Features like (full) ASLR / SIP / kext controls were added well after competitors.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#72

Post by pbgcp2026 »

guessmyname wrote: post #42
concinds wrote: post #22

I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s…

[flagged]

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#73

Post by dyauspitr »

maximilianburke wrote: post #38

I haven't been able to update my iPhone in months because it just does not have enough room available to download the update. I just checked now and it needs 13.2 GB free to be able to update to iOS 26.5 (from 26.3). On a 64gb device! It just seems like massive software development malpractice to tie together critical operating system updates with whatever else they've bundled.

It’s insane. It’s always an ordeal. They put so little storage on these phones that 20% of it is for iOS/system already. On top of that requiring 13-15 GB for an update is a huge pain.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#74

Post by pbgcp2026 »

firesteelrain wrote: post #28
three_burgers wrote: post #18

CVE-2026-28952 is about an integer overflow due to lack of input validation. I wonder what makes such vulnerability difficult to discover by traditional SAST tools?

Fuzzing, dynamic analysis or DAST might have found it too. Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

... because it was vibe coded by someone in ... other country. Cut the corners, deliver fast! Consume tokens!

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#75

Post by JCattheATM »

KennyBlanken wrote: post #45
JCattheATM wrote: post #37

Earlier quoted context omitted.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years. That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux…

> They were not "coasting" on anything.

Yeah, they were. Virus writers were not targeting them as a platform because why develop for 10% marketshare when you can target 90% for free. It just wasn't worth it to target as a platform. So there was some level of protection due to lack of interest in distributed attacks, but the OS had very little protection against targeted attacks.

> Apple has led the pack in nearly every major OS security feature of the last 25 years.

What an absurd claim. Apple trails behind, it never leads in this space. Windows 7 had numerous protections that had become standards that Apple still lacked when Windows 10 came out.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#76

Post by JCattheATM »

KennyBlanken wrote: post #57
jonhohle wrote: post #48

Earlier quoted context omitted.

Didn’t Microsoft pioneer the privilege escalation prompts in Vista in 2007? It was a joke at the time how little things would hijack the entire screen to allow seemingly mundane things. I didn’t ever use Vista personally or professionally, but macOS has become pretty bad with basically the same model.

MacOS X prompted users for their passwords in 2001. Microsoft's implementation was (twenty years later still is) a joke because it prompted users to hit enter or click a button.

Microsoft's Secure Desktop feature is actually incredibly well designed, and provides strong protect against fraudulent prompts or prompt interception attacks.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#77

Post by kimixa »

tptacek wrote: post #47
firesteelrain wrote: post #28

Earlier quoted context omitted.

Fuzzing, dynamic analysis or DAST might have found it too. Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

Then why didn't they?

I think the real point is they didn't - until it became a "marketing" thing for another company who did it for them.

A lot of these issues would be highlighted by "legacy" (pre-AI) analysis tools. The issue is that they weren't being run.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#78

Post by kilpikaarna »

jonhohle wrote: post #48
KennyBlanken wrote: post #45

Earlier quoted context omitted.

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years. That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux…

Didn’t Microsoft pioneer the privilege escalation prompts in Vista in 2007? It was a joke at the time how little things would hijack the entire screen to allow seemingly mundane things. I didn’t ever use Vista personally or professionally, but macOS has become pretty bad with basically the same model.

It was a joke mainly because of badly designed Windows apps being used to running as root in XP and earlier would ask for permissions _all_the_time_.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#79

Post by dwaite »

JCattheATM wrote: post #37
xyzzy123 wrote: post #35

Earlier quoted context omitted.

What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.

My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, fo…

Windows and macOS both got ASLR in 2007.

For another example: macOS integrated antivirus in 2009, while Windows did so in 2012.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#80

Post by dwaite »

jonhohle wrote: post #48
KennyBlanken wrote: post #45

Earlier quoted context omitted.

They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years. That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux…

Didn’t Microsoft pioneer the privilege escalation prompts in Vista in 2007? It was a joke at the time how little things would hijack the entire screen to allow seemingly mundane things. I didn’t ever use Vista personally or professionally, but macOS has become pretty bad with basically the same model.

IMHO, both are a mode of progressively penalizing developers as a mode of API obsoletion. It doesn't feel like the opportunity to fix a degradation of user experience really motivated app developers in either case.

The difference is Apple is much more likely to progressively make these legacy feature compatibility more difficult for users to configure over time, and to remove them eventually.

Post reply on HN