Loading story…
Apple is reportedly preparing a fix for an iOS 26 bug that can permanently lock users out of their iPhones when a custom alphanumeric passcode includes a special character removed from the lock-screen keyboard. The issue drew attention after university student Connor Byrne said his iPhone 13 became inaccessible because his passcode used the Czech caron/háček character, which disappeared from the available keyboard options after the September 2025 update.
Because the missing character could no longer be entered, affected users were left with a choice between staying locked out or performing a factory reset that would erase locally stored data such as photos and files. Reports say Apple engineers began investigating after Byrne's account spread online and are now working on a targeted remedy for a future major iOS 26 release, though the company has not publicly confirmed a timeline or responded to media requests for comment.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
According to reporting, Apple engineers became aware of the issue last week and started internal work on a software fix shortly after Byrne's post gained attention online. The remedy is reportedly being prepared for a future major iOS 26 release.
Byrne described the issue publicly on Reddit, drawing broader attention to the iOS 26 passcode bug affecting users with certain Czech keyboard characters in their passcodes. His social media post helped surface the problem beyond his individual case.
University student Connor Byrne reported that his iPhone 13 became inaccessible because his passcode included the caron/háček character that disappeared from the lock-screen keyboard after the upgrade. The only built-in recovery option was restoring the device and losing locally stored data, so he remained locked out.
After iOS 26 shipped in September 2025, a Czech keyboard character used in some custom alphanumeric passcodes was no longer available on the iPhone lock-screen keyboard. This created a bug that could prevent affected users from entering their existing passcodes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple disclosed multiple security fixes for supported iPhone and iPad devices, including `CVE-2025-24200`, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and `CVE-2025-43200`, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue. Further reporting tied `CVE-2025-43200` to a zero-click Messages exploitation chain used to install Paragon's **Graphite** spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for `iOS 26.0.1` and `iPadOS 26.0.1` fixed `CVE-2025-43400`, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.
Jul 24, 2026
Apple published security advisories detailing vulnerability fixes across multiple iOS and iPadOS versions, including iOS/iPadOS **16.7**, **17.2**, **18.1**, **18.3**, **26.1**, and **26.2**. The advisories describe a range of impacts such as sandbox escapes (including Web Content sandbox breakout), privacy issues where apps could access or expose sensitive user data via insufficient log redaction, file-system modification via temporary-file handling, and memory-safety flaws (e.g., out-of-bounds reads, type confusion, and bounds-checking issues) that could lead to crashes or memory corruption. Apple attributes fixes to changes like improved protocol handling, cache handling, input validation, and additional permission restrictions, and references issues by **CVE** where available. Several advisories also highlight device-state and authentication/logic weaknesses: iOS/iPadOS 18.3 includes a case where an attacker with physical access to an **unlocked** device could access Photos while the app is locked (`CVE-2025-24141`), while iOS/iPadOS 18.1 includes a lock-screen exposure issue (`CVE-2024-44274`) and a Shortcuts-related path-handling flaw that could allow arbitrary shortcut execution without user consent (`CVE-2024-44255`). The iOS/iPadOS 26.x advisories include privacy and permission issues (e.g., identifying installed apps, screenshots of sensitive embedded views), potential kernel memory corruption/system termination conditions, and logic/UI issues affecting security posture (e.g., passcode requirement timing after Face ID enrollment restore scenarios and potential FaceTime caller ID spoofing), with multiple findings credited to external researchers and teams (including Google Project Zero, ByteDance IES Red Team, and others).
Jun 29, 2026
Apple released out-of-band updates for **iOS 26.4.2**, **iPadOS 26.4.2**, **iOS 18.7.8**, and **iPadOS 18.7.8** to fix **CVE-2026-28950**, a privacy flaw in Notification Services that could cause notifications marked for deletion to remain stored on affected iPhones and iPads. Apple said the issue was caused by a logging problem and was resolved through improved data redaction, affecting supported devices across both current and older OS branches. Apple did not say whether the bug had been exploited or why the fix was issued outside the normal release cycle, but government guidance from the Canadian Centre for Cyber Security urged users and administrators to apply the updates. Reporting on the patch noted similarities to a recent case in which investigators reportedly recovered Signal message content from an iPhone's internal notification storage after the app had been deleted, though Apple has not publicly connected the update to that incident.
Jun 29, 2026