Loading story…
Researchers at Photon reported a bug in Apple’s XNU kernel that can cause macOS 26 systems with long continuous uptime to stop accepting new TCP/IP connections after roughly 49 days, 17 hours, 2 minutes, and 47 seconds. The flaw stems from an overflow in the 32-bit unsigned tcp_now counter used by the TCP stack; once it wraps, the internal TCP timestamp clock stops behaving correctly, TIME_WAIT connections are no longer cleaned up, ephemeral ports accumulate, and the system gradually loses the ability to establish new TCP sessions. Existing connections may continue to function, and ICMP traffic such as ping can still succeed, making the failure less obvious at first.
Photon said it reproduced the issue on machines used to monitor iMessage services and traced the root cause to a comparison in the kernel’s TCP handling that appears inconsistent with behavior described in RFC 7323. Reports indicate the bug affects macOS 26 rather than earlier releases, and that most consumer users are unlikely to encounter it because routine updates and reboots usually occur before the uptime threshold is reached. For long-running Macs, especially server-like systems that rarely reboot or sleep, the current workaround is simply to restart the machine until Apple releases a fix.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A subsequent analysis highlighted that the bug appears to affect macOS 26 rather than earlier versions and is unlikely to impact most consumer users because their Macs are typically rebooted before reaching the uptime threshold. It advised operators of long-running Macs and servers to monitor systems or restart them proactively until Apple releases a fix.
Photon publicly disclosed that long-running macOS 26 systems can gradually lose the ability to establish new TCP/IP connections due to the kernel timestamp overflow bug. The report noted that rebooting restores functionality and suggested the issue may relate to Apple's implementation of behavior described in RFC 7323.
Researchers at Photon identified a macOS XNU kernel bug on systems used to monitor iMessage services, reproduced it on two machines, and traced it to a 32-bit tcp_now counter overflow that occurs after 49 days, 17 hours, 2 minutes, and 47 seconds of uptime. The flaw causes TIME_WAIT connections to stop expiring, ephemeral ports to be exhausted, and new TCP connections to eventually fail while some existing connectivity may continue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
tidbits.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026
Apple quietly changed its security report intake in June 2026 to limit how many active vulnerability submissions some researchers can keep open at once, after a wave of AI-assisted reports increased triage pressure and included many claims the company considered low-quality or nonexistent. The company now requires human validation before confirming submissions, allows researchers to request higher limits, and is also using AI internally to help process incoming reports. Apple’s bug bounty rules already warn that repeated ineligible or theoretical AI-generated submissions can trigger a 180-day suspension or permanent removal from the program. The policy drew attention after Italian security startup **Bynario** said its Atlas platform, using **GPT-5.5**, identified more than 50 possible flaws in the latest macOS release within three weeks, but the cap initially prevented it from submitting all findings. Apple and Bynario both acknowledged that at least one report was valid: **`CVE-2026-43760`**, a macOS Screen Sharing flaw that could allow an authenticated **VNC** user to access protected data and create files with root privileges, later fixed in **macOS Tahoe 26.6**. The dispute has highlighted a broader industry problem as AI speeds up vulnerability discovery faster than vendors and bug bounty platforms can review reports, raising concerns that blunt submission limits could also delay legitimate disclosures.
Aug 6, 2026
Researchers Moshe Kol, Amit Klein, and Yossi Gilad demonstrated that Linux systems using the pre-5.18 TCP source-port selection algorithm could be remotely fingerprinted by a hostile website. By inducing and detecting collisions in a per-device-keyed, 256-entry source-port counter table, an attacker could derive a persistent per-boot identifier in roughly 10,000 connection attempts and about ten seconds. The identifier could link activity across browsers, private-browsing sessions, websites, containers, IPv4/IPv6 networks, and in some cases VPNs. The tracking identifier generally persisted until reboot, while NAT port rewriting and Tor could limit the technique. Following coordinated disclosure, Linux 5.18 added mitigations: time-varying hash input, randomized counter increments, and expansion of the counter table to 65,536 entries, making collision discovery and practical remote fingerprinting substantially harder.
Aug 26, 2026