Loading story…
Apple fixed CVE-2026-20685, a path traversal flaw in its Private Cloud Compute (PCC) environment that could allow an attacker to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. The vulnerability was found in darwin-init, a root-privileged early boot component that extracted attacker-controlled archives without properly blocking traversal sequences, enabling writes outside the intended directory and onto PCC's writable data volume. Apple rated the issue as information disclosure with a CVSS score of 6.5 and addressed it in PCC releases 5E290.3 and later.
Research showed a crafted archive could persist across boot and modify PCC logging behavior through splunkloggingd configuration, exposing metadata tied to Apple Intelligence inference requests inside Apple's Virtual Research Environment. The work, published through Sentry's AI security research effort, also highlighted an attestation gap because files on the writable data volume that could influence runtime daemon behavior were not included in PCC attestation measurements. Sentry researcher Drinor reported the flaw and received a $150,000 Apple Security Bounty.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Apple awarded Drinor a $150,000 Security Bounty for the CVE-2026-20685 finding affecting Private Cloud Compute. The award was cited in coverage of Sentry's AI security research into Apple's privacy-focused cloud AI architecture.
Apple remediated CVE-2026-20685 in Private Cloud Compute releases 5E290.3 and later. Apple classified the issue as an information disclosure vulnerability with a CVSS score of 6.5.
Sentry Security researcher Drinor discovered and reported CVE-2026-20685, a path traversal flaw in Apple's Private Cloud Compute that could enable root file writes during node boot and redirection of AI inference telemetry. The research also identified an attestation gap involving writable data volume files that could affect runtime daemon behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceheise.de
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that Apple’s fix for `CVE-2021-30724` in the root-privileged `CVMServer` daemon introduced a new flaw, tracked as `CVE-2022-26721`, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled `munmap` operations on arbitrary memory pages inside the service. Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer `CVMServer` memory layout, and overwriting `dyld` private-memory function pointers. A proof of concept reportedly read `/var/db/SystemKey`, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing `malloc` with `calloc` to ensure the descriptor buffer was zero-initialized.
Jul 24, 2026
A race condition in Apple’s userspace entitlement and code-signing checks allowed local attackers to bypass authorization in privileged IPC services and escalate to root. Project Zero documented the underlying weakness as racy validation tied to process identity, while a later public write-up showed the issue in practice in `com.apple.appleseed.fbahelperd`, Apple’s privileged Feedback Assistant XPC service, tracked as **CVE-2019-8565**. The exploit abused PID reuse to impersonate a trusted client after the daemon validated the wrong process context, defeating entitlement checks that should have restricted access. Once inside the service, an attacker could invoke `copyLogFiles:` to copy arbitrary files through path traversal and chain additional helper behavior to achieve root code execution; Apple addressed the flaw in **macOS 10.14.4** and **iOS 12.2**, and researchers said the bug reinforced that PID-based authorization in macOS IPC should be replaced with audit-token-based validation.
Aug 1, 2026
Researchers disclosed **SharedRoot**, a sandbox escape affecting Anthropic’s Claude Cowork local execution environment on macOS. The attack chain lets an AI agent running inside a Linux virtual machine exploit Linux kernel privilege-escalation bug `CVE-2026-46331` ("pedit COW") to gain root in the guest, then reach writable files on the macOS host through a VirtioFS mount that exposed host storage inside the VM. Researchers described the issue as an **architectural isolation failure**, not a direct compromise of Apple’s Virtualization Framework or macOS hypervisor protections. Accomplish AI said roughly **500,000 macOS users** running local Claude Cowork sessions were potentially affected before Anthropic switched to **cloud execution by default**. The disclosure warned that users who continue to run local execution may still be exposed because guest root can access host-user files through the shared mount. Recommended mitigations include limiting mounts to explicitly shared directories, using read-only mounts where possible, reducing guest kernel and namespace attack surface, and further isolating the `coworkd` daemon.
Jul 25, 2026