Loading story…
Apple has launched Memory Integrity Enforcement (MIE), a hardware-software security feature in the new iPhone 17 and iPhone Air models. MIE leverages Enhanced Memory Tagging Extension (EMTE) and Tag Confidentiality Enforcement (TCE) to provide always-on memory safety, targeting memory corruption vulnerabilities exploited by mercenary spyware. While MIE significantly raises the cost and complexity of exploit development, it is only available on the latest devices, limiting its reach for high-risk users with older hardware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Project Zero reported that the first handset with **ARM Memory Tagging Extension (MTE)** reached the market, marking a notable deployment of hardware-backed memory-safety defenses aimed at detecting classes of memory corruption such as use-after-free and out-of-bounds access. The rollout followed Project Zero's earlier implementation testing of MTE, which examined how the feature behaves in practice and highlighted its potential to harden user-space software against exploitation techniques long used in browser and sandbox escapes. Subsequent analysis of MTE in major heap allocators found that the protection materially improves heap-corruption mitigation but leaves important differences in coverage and bypass resistance. Research comparing Chrome's **PartitionAlloc**, **glibc ptmalloc**, and Android's **Scudo** said allocator design choices affect tag randomization, chunk-size coverage, and performance, and noted a previously reported weakness in PartitionAlloc's deterministic tag increment and tag reuse that could let a use-after-free attacker cycle tags to evade checks under some conditions. The findings also said MTE does not fully solve uninitialized memory, stack safety, large shared-buffer protection, or all `mmap`-backed allocation cases, underscoring that the new handset support is a meaningful but incomplete step in reducing memory-corruption risk.
Aug 24, 2026
Apple said it has not observed any successful mercenary spyware compromises on devices with **Lockdown Mode** enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in **zero-click** exploit chains. Independent findings cited by Apple support the claim. Researchers at **Amnesty International** and **Citizen Lab** said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked **Pegasus** and **Predator** spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Jun 29, 2026
Apple sent a new round of threat notifications to users it believes were targeted by **mercenary spyware** capable of compromising `iPhone`, `iPad`, and `Mac` devices. The company said the latest alerts reached customers in **110 countries**, and that it has now notified users in **more than 150 countries** since launching the program. The updated warning process includes a **lock-screen push notification**, an email, and a notice on the user’s Apple account page, reflecting a broader effort to ensure suspected victims recognize the seriousness of the targeting. Apple’s guidance tells recipients to seek expert help and enable **Lockdown Mode**, a hardened security setting designed for people at elevated risk of targeted attacks. According to Apple, it has not observed a case in which a device was successfully compromised while Lockdown Mode was enabled. Researchers said the stronger notification flow can help victims identify spyware targeting earlier and may support wider investigations into abuse by governments and commercial surveillance vendors.
Aug 20, 2026