Loading story…
Apple released security updates for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism.
The updates follow disclosure of CVE-2026-39875, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged cupsd daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a file:// device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Apple released macOS 26.6.1 Tahoe, macOS 15.7.9 Sequoia, and macOS 14.8.9 Sonoma to fix a Screen Sharing vulnerability that could let a network attacker authenticate without valid credentials. The source says there is no indication the flaw has been exploited in the wild.
On August 6, 2026, Apple released macOS Tahoe 26.6.1 and said the update includes security fixes. The referenced release notes did not identify specific CVEs or affected components.
Security researcher Dallas Dubs released a public proof-of-concept for CVE-2026-39875 showing how two logic flaws in the privileged cupsd daemon can be chained to achieve arbitrary root-owned file writes from an unprivileged local account. The repository includes demonstrations against vulnerable Tahoe 26.4.1, Sequoia 15.7.5, and Sonoma 14.8.5 systems.
Apple addressed CVE-2026-39875, a macOS CUPS vulnerability that allows arbitrary file writes with root privileges, in macOS Tahoe 26.6, Sequoia 15.7.8, and Sonoma 14.8.8. The source does not provide a specific release date for these patches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourceacn.gov.it
Open sourcezdnet.com
Open sourcesecurityweek.com
Open sourcetidbits.com
Open sourcemacrumors.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **macOS Sequoia 15.7.5** and **macOS Sonoma 14.8.5**, patching a wide range of vulnerabilities across core operating system components, networking, printing, privacy controls, the kernel, and bundled open-source software. The advisories describe flaws that could lead to **privilege escalation**, **sandbox escape**, **unauthorized access to sensitive data**, **kernel memory disclosure**, **denial of service**, **arbitrary file write**, and modification of protected file system areas. Affected components include high-risk areas such as **Kernel**, **CoreServices**, **CUPS**, **CFNetwork**, **NetAuth**, **SMB**, **TCC**, **Security**, and **PackageKit**, with additional privacy-related fixes for apps and services including **Mail**, **Messages**, **Focus**, **Phone**, and **Spotlight**. Apple also shipped patches for third-party code in **Apache**, **curl**, and ImageIO-related libraries, and credited external researchers and organizations including **KU Leuven**, **Google**, **Trend Micro Zero Day Initiative**, **Nosebeard Labs**, **DBAppSecurity WeBin lab**, and Renault researchers for reporting the issues.
Jun 29, 2026
Apple released **Safari 26.4** and **Xcode 26.4** security updates to address multiple vulnerabilities affecting macOS systems. The Safari update for **macOS Sonoma** and **macOS Sequoia** fixes seven `CVE`-tracked issues in **WebKit** and **WebKit Sandboxing** that could enable **Content Security Policy** and **Same Origin Policy** bypasses, **cross-site scripting**, process crashes, cross-origin access to script message handlers, improper processing of restricted web content, and user fingerprinting. Apple said the flaws were mitigated through improved state management, input validation, logic checks, memory handling, and authorization controls. The **Xcode 26.4** advisory covers two vulnerabilities on systems running **macOS Tahoe 26.2 and later**. Apple patched an out-of-bounds read in `otool` (`CVE-2026-28890`) that could let an app trigger an unexpected system termination, and a permissions flaw in **Simulator** (`CVE-2026-28889`) that could allow an app to read arbitrary files as **root**. Apple credited external researchers for the findings and made the updates available through the **Mac App Store**, developer download channels, and its security releases pages.
Jun 29, 2026
Apple patched two kernel memory disclosure vulnerabilities in the macOS `smbfs` driver, tracked as **CVE-2021-30844** and **CVE-2021-30845**, affecting macOS Big Sur 11.0 through 11.2.3. Both flaws could expose adjacent kernel heap data during SMB operations, creating conditions that could aid further exploitation. STAR Labs reported that Apple was notified in June and released fixes alongside security updates for affected systems. `CVE-2021-30844` stems from the `SMBIOC_T2RQ` `ioctl` path, where attacker-controlled data copied into `t2p->t_name` may not be NULL-terminated before later string handling, causing an out-of-bounds read and leaking kernel memory to an SMB server. `CVE-2021-30845` affects `smbfs_mount`, where insufficient validation of `unique_id_len` against the fixed-size `unique_id` buffer in `smb_mount_args` can also trigger an out-of-bounds read during a mount request. Proof-of-concept demonstrations used fake or controlled SMB servers to show unintended kernel data disclosure, and the recommended mitigation is to update macOS to the latest available version.
Jun 29, 2026