On November 4, 2026, the US Cybersecurity and Infrastructure Security Agency added an Apple flaw to its list of bugs that criminals are using right now. [1] The flaw is tracked as CVE-2024-27834 and sits in WebKit, the engine behind Safari and every browser on an iPhone. Apple fixed it in May 2024, so anyone who installs updates is already covered. People who skipped them, or who own an old iPhone stuck on an early version of iOS 16, are the ones in danger.
CISA put the bug in its Known Exploited Vulnerabilities catalog, which is reserved for flaws with evidence of real attacks. [1] Federal agencies must fix it by November 18, 2026. [1] [3] The listing came on the same day that security firm Sekoia published research on a spy campaign that used the flaw as one step in a longer attack chain. [2]
Sekoia says the operators compromised ordinary websites, built lookalike sites and tampered with a script from Plerdy, a Ukrainian SEO and analytics tracker that thousands of sites load. [2] According to the report, the tracker served a malicious loader between August 27 and September 3, 2026, and the vendor cleaned it up after a week. [2]
Visiting an infected page was enough. According to the researchers, nobody had to tap or download anything: a phone or tablet missing its updates could be compromised just by loading the page. [2] A script first profiled the visiting device, then served the exploit chain that matched its software.
The Apple bug itself is a way around Pointer Authentication, a hardware protection that makes it harder to hijack memory. Apple's own description says an attacker needs arbitrary read and write access first, so this flaw is a middle step, not a way in on its own. [3] Sekoia explained that the bypass lets attackers forge the pointers they need to run their own code. [1] For older iPhones the chain paired it with a second WebKit bug, CVE-2025-43529, and ended in cookie theft, including cookies kept inside app containers. [2]
The exposed group is narrower than all iPhone owners. The Apple flaw matters for any device that has not received the May 2024 updates. That covers iPhones and iPads below 16.7.8 (or below 17.5 on the newer branch), Macs on Sonoma before 14.5, Apple TV and Apple Watch software from before the same round, and Safari older than 17.5. [1] [3] Sekoia's first chain aimed at iPhones running iOS 16 up to 16.7.7, plus the early iOS 17 releases up to 17.4. [2]
Newer iPhones were not left out of the campaign. A second chain aimed at iOS 18 versions before 18.7.3 and iOS 26 versions before 26.3, and a third went after Chrome 139 to 145 on Android, taking cookies, saved logins, history and Wi-Fi settings. [2] The researchers say none of the flaws in those chains was a zero-day, meaning every one had a patch before the campaign began. [2]
What was taken and why cookies matter
A cookie is a small file that keeps you logged in to a site. If a thief copies it, they can sometimes act as you without knowing your password, and a second login code may not stop them. That makes cookie theft attractive for email, social media, banking and work accounts. Malware that collects this kind of data is called an infostealer, and it is the same family of tools described in our guide to the Agent Tesla trojan .
Sekoia puts the blame on APT29 and rates its own confidence as moderate to high. [2] That is the Russia-linked espionage group also known as Midnight Blizzard or Cozy Bear. [2] Security Affairs stresses that this is Sekoia's judgment and not a finding by CISA or Apple. [1] CISA itself calls this kind of bug "a frequent attack vector for malicious cyber actors." [1]
What Apple and the researchers say
Apple has not published a workaround, so installing the update is the only fix. [3] Sekoia's summary is blunt: "Sekoia found no zero-day in any of the three chains." [2] One open point remains. The researchers state that another flaw in the iOS 18 chain, CVE-2026-20700, was still unfixed on the iOS 18 line as of November 5, so owners of those phones should move to iOS 26.3 if their model supports it. [2]
Open Settings, then General, then Software Update, and install whatever is offered. If your iPhone can run iOS 26.3, take it.
If your phone cannot go past iOS 16, make sure it is on 16.7.8 at least. If it cannot update at all, avoid logging in to email or banking on it and plan to replace it.
On Android, update Chrome to version 146.0.7680.75 or later and install your phone maker's latest security update. [2]
If an old, unpatched phone visited a site you suspect, sign out of important accounts everywhere, change passwords from a clean device and check recent logins. [2]
Expect more of this, because many people update late and a bug fixed in 2024 still pays off in 2026. For another Apple fix, see Apple's emergency CoreAudio patch , and for odd phone behavior, read the Android virus .
Frequently asked questions
It is CVE-2024-27834, a Pointer Authentication bypass in WebKit that Apple fixed in May 2024. CISA listed it on November 4, 2026.
This particular bug is not a risk on versions that include the 2024 fix, such as iOS 17.5 or iOS 16.7.8 and later. Other chains in the campaign hit iOS 18 before 18.7.3 and iOS 26 before 26.3, so keep updating.
Security firm Sekoia names the Russia-linked group APT29, with moderate to high confidence on its own scale. That is the firm's view, not a confirmed finding by CISA or Apple.
Stolen cookies can let an attacker use your logged-in sessions on sites such as email and social media, sometimes without needing your password.
No. Every flaw in all three exploit chains already had a fix before the campaign started, according to Sekoia's analysis.
No yet. Be the first.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
