Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

support.apple.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#91

Post by NekkoDroid »

pjmlp wrote: post #86
KennyBlanken wrote: post #57

Earlier quoted context omitted.

MacOS X prompted users for their passwords in 2001. Microsoft's implementation was (twenty years later still is) a joke because it prompted users to hit enter or click a button.

Only if you configure it like that, you can make it ask for a password, and on more recent versions of Windows 11, optionally, a single use token. Ironically Apple just recently added the same simpified approach.

> Only if you configure it like that

It is the default (unless they changed it in the last 2 years or so). I know for a fact that my PC and Laptop don't ask for my password and I know for a fact that I reinstalled Windows on my laptop less than 2 years ago and changed nothing regarding the UAC prompt (the closest that is even remotely close is enabling sudo in the settings).

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#92

Post by [deleted] »

guessmyname wrote: post #42
concinds wrote: post #22

I wonder how well Apple has deployed these tools internally for security research. Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has…

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s…

[deleted]

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#93

Post by Someone »

tptacek wrote: post #47
firesteelrain wrote: post #28

Earlier quoted context omitted.

Fuzzing, dynamic analysis or DAST might have found it too. Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

Then why didn't they?

Could be any (combination) of

- looking at components in isolation, not realizing that a component could receive untrusted input

- looking at the entire system, but not in a configuration that made the CVE possible

- having to be extremely lucky to find the issue through fuzzing, and Apple not hitting that jackpot

- having found the issue in testing, but incompletely/incorrectly fixing it

- mostly focusing testing on other components because this one’s code didn’t change and hadn’t seen issues in years

I don’t think we have enough info to know which (or something entirely different) it is.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#94

Post by pjmlp »

NekkoDroid wrote: post #91
pjmlp wrote: post #86

Earlier quoted context omitted.

Only if you configure it like that, you can make it ask for a password, and on more recent versions of Windows 11, optionally, a single use token. Ironically Apple just recently added the same simpified approach.

> Only if you configure it like that It is the default (unless they changed it in the last 2 years or so). I know for a fact that my PC and Laptop don't ask for my password and I know for a fact that I reinstalled Windows on my laptop less than 2 years ago and changed nothing regarding the UAC prompt (the closest that is even remotely close is enabling sudo in the settings).

May be, I never leave defaults on neither does our IT, so I might have that wrong.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#95

Post by tptacek »

firesteelrain wrote: post #90
tptacek wrote: post #89

Earlier quoted context omitted.

Why not? We're talking about vulnerabilities with real market value here. If it was just a tool run, why weren't the tools run? Isn't the simpler explanation that they weren't just a tool run?

The tools are expensive. One of the major players in the market have really expensive licensing fees. Then the developers all need to be trained on how to use the tools and understand the results. It’s not something they teach effectively in schools. Software engineering is still kind of new overall.

Which tool specifically are you thinking of that might have found this but wasn't run because of it's very high licensing fees? I work in this field, I'll be familiar with it.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#96

Post by akerl_ »

firesteelrain wrote: post #90
tptacek wrote: post #89

Earlier quoted context omitted.

Why not? We're talking about vulnerabilities with real market value here. If it was just a tool run, why weren't the tools run? Isn't the simpler explanation that they weren't just a tool run?

The tools are expensive. One of the major players in the market have really expensive licensing fees. Then the developers all need to be trained on how to use the tools and understand the results. It’s not something they teach effectively in schools. Software engineering is still kind of new overall.

Apple has a massive information security organization that has pretty intense resources at their disposal.

It seems borderline impossible that there's a tool that they feel would be beneficial but that they're classed out of using by license costs or by staff proficiency.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#97

Post by atonse »

alwillis wrote: post #39
atonse wrote: post #31

Earlier quoted context omitted.

Yeah I’m honestly not sure why macOS updates seem to be so huge. Often gigabytes. Do they actually have thousands of changes, so they basically ship out new versions of almost all system libraries? Or is it that they don’t have good diffing in place? Or is it a BSD thing where you basically ship everyone at once since it’s all sort of “one version” of the base system?

> Yeah I’m honestly not sure why macOS updates seem to be so huge. An update to macOS 26.5 contains all the necessary code to update a Mac from 26.0 to 26.5 for both x86_64 and arm64 architectures.

But aren't they able to do incremental builds and separated x64/arm64?

They know which OS version is requesting an update, at least the version number part.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#98

Post by firesteelrain »

tptacek wrote: post #95
firesteelrain wrote: post #90

Earlier quoted context omitted.

The tools are expensive. One of the major players in the market have really expensive licensing fees. Then the developers all need to be trained on how to use the tools and understand the results. It’s not something they teach effectively in schools. Software engineering is still kind of new overall.

Which tool specifically are you thinking of that might have found this but wasn't run because of it's very high licensing fees? I work in this field, I'll be familiar with it.

Black Duck products

https://www.blackduck.com/fuzz-testing.html

OpenText products

https://www.opentext.com/products/dynamic-application-securi...

I won’t say how much they are here but they are very expensive.

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#99

Post by alwillis »

atonse wrote: post #97
alwillis wrote: post #39

Earlier quoted context omitted.

> Yeah I’m honestly not sure why macOS updates seem to be so huge. An update to macOS 26.5 contains all the necessary code to update a Mac from 26.0 to 26.5 for both x86_64 and arm64 architectures.

But aren't they able to do incremental builds and separated x64/arm64? They know which OS version is requesting an update, at least the version number part.

> But aren't they able to do incremental builds and separated x64/arm64?

During the PowerPC to Intel transition, they did stuff like that; perhaps at their current scale, there's reasons why they don't.

Supporting both architectures enables a macOS install to boot an Intel Mac or an Apple Silicon Mac, which is useful in a dual-architecture environment.

It's easy to check for dual architecture support; just use the file command:

    $ file /bin/ls
    /bin/ls: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e]
    /bin/ls (for architecture x86_64): Mach-O 64-bit executable x86_64
    /bin/ls (for architecture arm64e): Mach-O 64-bit executable arm64e

Re: CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude

#100

Post by firesteelrain »

akerl_ wrote: post #96
firesteelrain wrote: post #90

Earlier quoted context omitted.

The tools are expensive. One of the major players in the market have really expensive licensing fees. Then the developers all need to be trained on how to use the tools and understand the results. It’s not something they teach effectively in schools. Software engineering is still kind of new overall.

Apple has a massive information security organization that has pretty intense resources at their disposal. It seems borderline impossible that there's a tool that they feel would be beneficial but that they're classed out of using by license costs or by staff proficiency.

It happens at a lot of places that the budget isn’t unlimited when it comes to information security. But even then it comes down to risk management.
Post reply on HN