Loading story…
Researchers from Calif disclosed a local privilege-escalation exploit against Apple systems using M5 silicon that reportedly bypasses the chip’s Memory Integrity Enforcement (MIE) protections and grants a root shell on macOS 26.4.1 from an unprivileged user context. The team said Anthropic’s Mythos Preview helped chain two previously unknown bugs and other techniques into a working exploit in five days, using only standard system calls. Apple was reportedly notified in advance and is working on a fix. The finding is significant because MIE was introduced to harden M5 and A19 devices against memory-corruption attacks such as buffer overflows and use-after-free flaws.
Microsoft separately detailed MDASH, an internal AI-driven vulnerability discovery platform that coordinates more than 100 specialized agents and has already found 16 previously unknown vulnerabilities in Windows networking and authentication components. Four of those flaws, including critical remote code execution bugs in tcpip.sys and the IKEv2 service, were patched in the latest Patch Tuesday release. Microsoft said MDASH also identified issues in IPsec and Netlogon, including vulnerabilities reachable over the network without credentials, and described the system as a production-grade defensive capability now in internal use and limited private preview.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Researchers said they withheld technical details on the SMBClient and WebDAV vulnerabilities until Apple released fixes in macOS 26.6. The patched bugs, CVE-2026-64704 and CVE-2026-64699, had been chained to bypass Memory Integrity Enforcement and enable kernel exploitation from an unprivileged context.
Calif publicly disclosed the Apple M5 local privilege-escalation exploit, describing how Anthropic's Mythos Preview helped chain bugs into a working bypass of Memory Integrity Enforcement. The disclosure highlighted that a standard user on macOS 26.4.1 could gain root access on affected M5 systems.
The Calif team disclosed the M5 local privilege-escalation vulnerability to Apple before publicly presenting it. Apple was reported to be aware of the issue and working on a fix.
Researchers from Calif developed a local privilege-escalation exploit against Apple M5 systems running macOS 26.4.1, chaining two previously unknown bugs and additional techniques to bypass MIE and obtain a root shell from an unprivileged local user context. The exploit reportedly relied only on standard system calls and was built within five days with assistance from Anthropic's Mythos Preview AI.
Microsoft publicly introduced MDASH as a multi-agent AI vulnerability discovery system used internally and made available in limited private preview to select customers. The company said the platform uses more than 100 specialized agents and highlighted benchmark results to support its production use.
Microsoft fixed four critical vulnerabilities discovered by MDASH in its current monthly Patch Tuesday release, including remote code execution issues affecting tcpip.sys and the IKEv2 service. The patched flaws were part of the 16 new bugs identified by the system.
Microsoft said its AI-driven MDASH system discovered 16 previously unknown vulnerabilities in Windows networking and authentication components, including flaws in the TCP/IP stack, IPsec/IKEv2, and Netlogon. Four of the findings were critical remote code execution issues reachable over the network without credentials.
Researchers from Calif identified the two previously unknown vulnerabilities that were later chained into the Apple M5 macOS local privilege-escalation exploit. The bugs were reportedly found on April 25 during research into bypassing Memory Integrity Enforcement on M5 systems.
Apple introduced the hardware-enforced Memory Integrity Enforcement (MIE) security feature for M5 and A19 chips in September 2025 to mitigate memory-corruption attacks such as buffer overflows and use-after-free bugs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceschneier.com
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcetechradar.com
Open sourcegovinfosecurity.com
Open sourcescworld.com
Open sourceblog.calif.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026
Akamai researchers have developed an AI-driven tool, PatchDiff-AI, designed to automate the root cause analysis of vulnerabilities patched during Microsoft's regular Patch Tuesday updates. This system leverages large language models in a multi-agent configuration to rapidly analyze patched binaries, identify the underlying security flaws, and generate detailed reports, including attack vector analysis and exploitability. The tool demonstrated over 80% success in fully automated report generation, significantly accelerating the defensive response to newly disclosed vulnerabilities. A recent case study applied PatchDiff-AI to CVE-2025-60719, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) for Winsock, which affects nearly all supported Windows versions. The flaw allows local privilege escalation by enabling a low-privilege attacker to manipulate kernel memory and gain system privileges. Microsoft addressed the issue by introducing a synchronization barrier to prevent unsafe unbinding of socket endpoints during critical operations. The research and tool were presented at Black Hat Europe Arsenal, highlighting the growing role of AI in vulnerability analysis and mitigation.
Jun 29, 2026
Microsoft released fixes for **117 vulnerabilities** across 15 product families, including **3 Critical**, **110 Important**, **3 Moderate**, and **1 Low** severity issues. Two flaws were already being exploited in the wild: `CVE-2024-43572` in **Microsoft Management Console** and `CVE-2024-43573` in the **Windows MSHTML Platform**. Microsoft also flagged eight additional vulnerabilities as more likely to be exploited within 30 days, while Windows accounted for the vast majority of the exposure with **93 CVEs** spanning remote code execution, elevation of privilege, and denial-of-service bugs. The most severe issues included `CVE-2024-43468`, a **Critical Microsoft Configuration Manager remote code execution** flaw with a **CVSS 9.8** score that requires an in-console update and additional hardening, and `CVE-2024-38124`, a **Windows Netlogon elevation of privilege** vulnerability with mitigation guidance. The release also addressed 15 Windows Mobile Broadband Driver flaws that generally require physical access or proximity, Windows 11 24H2-specific bugs such as `CVE-2024-43527` and `CVE-2024-43571`, and advisory items affecting Edge and curl-related components; Sophos said protections were available for `CVE-2024-43502`, `CVE-2024-43572`, and `CVE-2024-43573`.
Jun 29, 2026