Loading story…
Apple disclosed security fixes in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, and Security Update 2019-002 Sierra that addressed local privilege-escalation flaws in Time Machine diagnostic components. Public research later detailed a command injection bug, tracked as CVE-2019-8513, affecting macOS 10.12.x through 10.14.3, where a local user could abuse the timemachinehelper XPC service and the tmdiagnose utility to execute arbitrary shell commands as root.
The exploit reportedly worked by crafting a mounted disk image label so shell metacharacters were injected into a command built from diskutil output, ultimately yielding a root shell after diagnostic tasks completed. The same research also described a related arbitrary file overwrite issue in XPC helpers, assigned CVE-2019-8530, and noted it could previously be chained with an older sudo timestamp weakness; the findings echoed earlier public work on browser-to-system compromise and underscored how trusted macOS helper services could be leveraged for full system takeover.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CodeColorist published a detailed writeup of the patched Time Machine command injection flaw, explaining how a crafted disk image label could trigger root command execution through timemachinehelper and tmdiagnose. The post also discussed the related arbitrary file overwrite issue tracked as CVE-2019-8530 and its prior exploitability with an older sudo timestamp flaw.
Apple released macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, and Security Update 2019-002 Sierra, addressing CVE-2019-8513 and CVE-2019-8530. Apple said the issues were fixed with improved checks and credited CodeColorist of Ant-Financial LightYear Labs.
A Black Hat USA 2016 paper by Samuel Groß and Niklas Baumstark documented exploitation techniques for escalating from a browser compromise to full system compromise on macOS. The later Time Machine vulnerability writeup references this prior research context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
support.apple.com
Open sourcecodecolor.ist
Open sourceblackhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher disclosed a three-bug macOS local privilege escalation chain that let an unprivileged user escalate to **root**, bypass **System Integrity Protection (SIP)**, and ultimately achieve kernel code execution on systems before `macOS 10.15.5`. The first flaw was in `authd`, where Authorization Services trusted entitlement data returned by `SecCodeCopySigningInformation` without first validating the caller’s code signature, allowing forged entitlements such as `com.apple.private.AuthorizationServices` to unlock privileged authorization rights. The chain then abused Apple-signed package installation through **PackageKit** and a vulnerable post-install script in `macOSPublicBetaAccessUtility.pkg` to execute code as root under `system_installd`, inheriting the `com.apple.rootless.install.heritable` entitlement and bypassing SIP. A third flaw in `kextutil` used a race condition to swap a verified Apple-signed kernel extension staged in `/Library/StagedExtensions/private` before loading; use of the `-interactive` flag made the race reliable enough to load malicious kernel code. The bugs were reported to Apple in 2020, and Apple addressed the issues in `macOS 10.15.6` and `tvOS 13.4.5`, including a change so `SecCodeCopySigningInformation` verifies signatures directly.
Jul 24, 2026
Apple released security updates for **macOS Tahoe 26.6.1**, **Sequoia 15.7.9**, and **Sonoma 14.8.9** to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism. The updates follow disclosure of **`CVE-2026-39875`**, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged `cupsd` daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a `file://` device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Aug 21, 2026
Researchers disclosed the first public bypass of Apple **Memory Integrity Enforcement (MIE)** on macOS 26.4.1 by chaining two vulnerabilities: `CVE-2026-64704` in **SMBClient** and `CVE-2026-64699` in **webdavfs**. The SMB flaw is a type confusion issue triggered when a macOS client connects to a malicious SMB server, causing the kernel to reinterpret a Resolve ID context as a lease context and misuse attacker-influenced kernel pointers. The WebDAV flaw is a kernel memory disclosure bug triggered by a crafted HTTP `206` response from a malicious WebDAV server, leaking uninitialized kernel memory to userspace. The researchers said the combined exploit chain produces arbitrary kernel read/write primitives and ultimately kernel code execution, allowing an unprivileged user to escalate privileges to **root** despite Apple’s layered kernel protections. Apple has patched both issues in macOS 26.6, and the disclosure was accompanied by a public exploit-development challenge and notice of a planned Black Hat USA presentation detailing the technique.
Jul 30, 2026