The iPhone Air is now free without a trade-in at Verizon - yep, that's $1,000 off
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Appleโs latest operating systems for its most popular devices โ iPhones, iPads and Macs โ include patches for multiple vulnerabilities, but the company didnโt issue any warnings about active exploitation.ย
Apple patched 27 defects with the release of iOS 26 and iPadOS 26 and 77 vulnerabilities with the release of macOS 26, including some bugs that affected software across all three devices. Appleโs new operating systems, which are now numbered for the year of their release, were published Monday as the company prepares to ship new iPhones later this week.
Users that donโt want to upgrade to the latest versions, which adopt a translucent design style Apple dubs โliquid glass,โ can patch the most serious vulnerabilities by updating to iOS 18.7 and iPad 18.7 or macOS 15.7. Most Apple devices released in 2019 or earlier are not supported by the latest operating systems.
None of the vulnerabilities Apple disclosed this week appear to be under active attack, Dustin Childs, head of threat awareness at Trend Microโs Zero Day Initiative, told CyberScoop.
Apple previously issued an emergency software update to customers last month to patch a zero-day vulnerability โ CVE-2025-43300 โ that was โexploited in an extremely sophisticated attack against specific targeted individuals,โ the company said in a series of updates for iOS, iPadOS and macOS.
The company has addressed five actively exploited zero-days this year, including defects previously disclosed in January, February, March and April. Seven Apple vulnerabilities have been added to the Cybersecurity and Infrastructure Security Agencyโs known exploited vulnerabilities catalog this year.ย
Unlike many vendors, Apple doesnโt provide details about the severity of vulnerabilities it addresses in software updates. Childs noted it would be helpful if Apple issued some sort of initial severity indicator alongside the vulnerabilities it patches โ even if it doesnโt follow the Common Vulnerability Scoring System.
A pair of vulnerabilities patched in macOS โ CVE-2025-43298, which affects PackageKit, and CVE-2025-43304, which affects StorageKit โ are concerning because exploitation could allow an attacker to gain root privileges, Childs said.ย
โOn the iOS side, I donโt see anything that makes me sweat immediately but there are a lot of bugs addressed,โ he added.
Apple also patched seven defects in Safari 26, 19 vulnerabilities in watchOS 26, 18 bugs in visionOS 26 and five defects in Xcode 26.ย
More information about the vulnerabilities and latest software versions are available on Appleโs security releases site.
The post Apple addresses dozens of vulnerabilities in latest software for iPhones, iPads and Macs appeared first on CyberScoop.
Read more of this story at Slashdot.
Appleโs new Memory Integrity Enforcement (MIE) brings always-on memory-safety protection covering key attack surfaces โ including the kernel and over 70 userland processes.
The post Apple Unveils iPhone Memory Protections to Combat Sophisticated Attacks appeared first on SecurityWeek.
Apple has unveiled a comprehensive security system called Memory Integrity Enforcement (MIE) that represents a five-year engineering effort to combat sophisticated cyberattacks targeting individual users through memory corruption vulnerabilities.
The technology is built into Appleโs new iPhone 17 and iPhone Air devices, as well as the A19 and A19 Pro chips. It combines custom-designed hardware with changes to the operating system to deliver what Apple describes as โindustry-first, always-onโ memory safety protection. According to Appleโs security researchers, the system is primarily designed to defend against sophisticated attacks from so-called โmercenary spyware,โ rather than from typical consumer malware.
โBased on our evaluations pitting Memory Integrity Enforcement against exceptionally sophisticated mercenary spyware attacks from the last three years, we believe MIE will make exploit chains significantly more expensive and difficult to develop and maintain, disrupt many of the most effective exploitation techniques from the last 25 years, and completely redefine the landscape of memory safety for Apple products,โ the company wrote in a blog posted Tuesday. โBecause of how dramatically it reduces an attackerโs ability to exploit memory corruption vulnerabilities on our devices, we believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems.โ
Memory corruption vulnerabilities have long accounted for some of the most pervasive threats to operating system security. These flaws happen when software doesnโt properly control how it reads from or writes to memory, allowing attackers to change, overwrite, or access parts of a computerโs memory they shouldnโt be able to.
Exploits targeting these flaws โ in particular buffer overflows and use-after-free errors โ have underpinned the sophisticated, multi-million-dollar exploit chain that powers spyware. Attackers exploit these flaws, often in โzero-clickโ (no user interaction required) scenarios, to run harmful code, steal data, or crash systems. For example, NSO Groupโs Pegasus spyware was powered by three memory corruption vulnerabilities that were chained together.ย
Recognizing this, Apple expanded efforts over the past five years to address memory safety โat scale.โ The company worked closely with the chip designer Arm to improve a memory protection system where memory checks happen immediately, every single time memory is used, instead of sometimes waiting, which could leave a small window open for attackers. This led to the creation of Enhanced Memory Tagging Extension (EMTE), a key part of Appleโs new system.
EMTE works by giving each piece of memory a special secret tag. Whenever the device tries to use a particular section of memory, the hardware checks the tag to make sure it is correct. If the tag doesnโt match what is expected, the device will immediately stop the program and record the incident. By ensuring every block of memory has its own unique tag, and by changing these tags whenever memory is reused, Appleโs system blocks unauthorized access efforts before they can cause damage.
โApple has a deep understanding of this problem space, and because they control both the hardware (Apple Silicon) and the software (iOS), they have the unique ability to engineer a tightly integrated and very effective security mechanism,โ said Patrick Wardle, co-founder and CEO of DoubleYou, a company that specializes in Apple security. โThis kind of approach, which depends on tight coupling between the chip and the operating system, is something most other vendors cannot replicate as easily since they do not own both sides of the stack.โ
The company acknowledges in a blog post that the system does not entirely eliminate spywareโs ability to be executed on an Apple device, but makes it extremely difficult for attacks to successfully run spyware or maintain access if a device has been compromised.ย
โWhile thereโs no such thing as perfect security, MIE is designed to dramatically constrain attackers and their degrees of freedom during exploitation,โ the blog post reads.ย
The efforts mirror similar systems put in place by Microsoft, which has a memory integrity feature in Windows 11, and Google, which has a similar system in its Pixel devices.
Natalia Krapiva, senior tech-legal counsel at Access Now, told CyberScoop she thought it was โgreatโ that Apple was taking effective measures since itโs โalways a cat-and-mouseโ game when large tech companies create ways to thwart spyware developers.
โThese spyware developers like finding new ways of targeting people, evading detection and so on,โ Krapiva told CyberScoop. โThis is great to see Apple coming up with new ways to protect high-risk users.
The one drawback Krapiva did highlight is that this system is only available on new devices. AccessNow works internationally with groups that are often targeted by spyware on devices that are several generations older than what most consumers use.ย
โFor our communities, oftentimes these are grassroots, independent media. Itโs very hard to afford new devices, especially Apple devices,โ she told CyberScoop. โIt could be a nice thing for Apple to have some kind of a program to allow for these types of groups to be able to access this.โ
MIE can also be taken advantage of by third-party applications, including social media and messaging applications. Additionally, EMTE is available to all Apple developers in Xcode, its developer toolkit, as part of the Enhanced Security feature it rolled out earlier this year.ย
The post Appleโs new Memory Integrity Enforcement system deals a huge blow to spyware developers appeared first on CyberScoop.
Read more of this story at Slashdot.