Apple fixed this bug back in May 2024. Hackers are using it anyway, because lots of iPhones, iPads and Macs never got updated.
The US government's cyber agency (CISA) added it to its list of flaws being actively used in real attacks this week. Researchers at Sekoia, a French security company, link the attacks to a Russian government-backed hacking group.
What happened
On November 4, 2026, CISA added an Apple flaw to its list of known, actively exploited security holes. US federal agencies have until November 18 to fix it. The flaw is tracked as CVE-2024-27834. A CVE is just a reference number security people use to name a specific flaw.
The Hacker News reports Sekoia found attackers using it as one piece of a chain of older Safari and Chrome flaws. Sekoia ties the activity, with "moderate to high confidence," to APT29, also called Cozy Bear, a group linked to Russia's foreign intelligence service.
The attackers lured people in three ways: real websites they had hacked, fake sites pretending to be popular ones, and a hacked add-on used on websites (the Plerdy SEO Tracker). Just visiting the page was enough. No clicking, no downloading.
What this means in plain English
Apple builds safety locks into its devices so one bad web page can't take over the whole thing. This bug lets an attacker get past one of those locks, once they've already got a foot in the door through another flaw.
The end goal here was your browser's cookies. Cookies are the little saved notes that keep you logged in, so you don't type your password every time you open email. Steal those and an attacker can often walk into your accounts as you, without your password and without the code on your phone.
Why a small business should care
Staff phones and iPads read company email, open shared files and sign in to banking and payroll. An out-of-date phone visiting the wrong website can hand over the keys to all of it.
Small offices rarely track which phones are updated. Personal phones used for work are often the worst offenders.
Who's affected
Apple devices that haven't been updated since spring 2024. Apple fixed it in these versions or later:
iPhone and iPad: iOS and iPadOS 17.5, or 16.7.8 for older models
Mac: macOS Sonoma 14.5
Safari 17.5
Apple TV: tvOS 17.5
Apple Watch: watchOS 10.5
Anything newer than these is fine for this bug. Anything older is exposed.
What to do: everyone
On an iPhone or iPad, open Settings, then General, then Software Update. Install whatever is waiting.
On a Mac, open the Apple menu, then System Settings, then General, then Software Update.
Turn on automatic updates on the same screen.
If your device says it's up to date but is stuck on an old version, it may be too old to get updates. Tell your IT person.
What to do: if you run the business
Get a list of every phone, tablet and Mac that touches company email or files, including personal ones.
Set a rule: if a device can't get updates anymore, it doesn't get company email.
Ask your IT provider to block out-of-date devices from signing in, where your setup allows it.
Questions to ask your IT provider
Can you show me which of our devices are behind on updates?
Can we stop old, unpatched phones from getting into company email?
If someone's login cookies got stolen, can you sign them out everywhere quickly?
Sources
The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
Security Affairs: U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Contact Nautalex to see how we can help you with keeping phones and tablets updated.
