iOS Security. Plain English.
Apple security advisories translated for engineers, CISOs, and anyone responsible for keeping iPhones out of the hands of attackers.
- iOS 27 – Massive Security ReleaseApple ships its largest iOS security update in years, patching 37 vulnerabilities including a critical zero-day remote code execution in WebKit.2026-10-12
- iOS 26.7.1 – CoreGraphics Zero-Day PatchedOut-of-band patch for a CoreGraphics zero-day used in targeted attacks against government officials across Europe.2026-09-28
- iMessage Zero-Click BlastDoor Bypass FoundPangu researchers demonstrate a zero-click exploit that circumvents BlastDoor sandbox isolation via a crafted image HEIC payload.2026-09-15
- Spyware targeting 110 Countries via iOS Photos AppA Pegasus-like spyware campaign exploits a Photos framework vulnerability to extract messages, contacts, and location history from 300K+ devices.2026-08-22
- iOS 27.2 – Kernel Extension Monitor IntroducedApple introduces kext monitoring in iOS 27.2, the first step toward a full kernel extension auditing system on iOS devices.2026-08-01
- Safari Private Tab Bypass on iOS 18 – Trackers Still FollowA researcher demonstrates how Safari Private tabs on iOS 18 leak referrer data through JavaScript-driven link interception.2026-07-18
- Safari XSS Vulnerability in URL Parsing – CVE-2024-40857 RevisitedA long-closed XSS vector in Safari's URL parser resurfaces in iOS 26 through a Unicode normalization bypass in the address bar.2026-06-30
- macOS Golden Gate 14.7 – Full Security BreakdownmacOS Sonoma 14.7 patches 42 CVEs including a full-disk encryption key leak and a Safari exploit chain targeting AirDrop.2026-05-28
- watchOS 11 – Security Changes You Should KnowwatchOS 11 introduces on-device passkey storage, a hardware-backed Secure Enclave enhancement, and new HealthKit access controls.2026-04-15
- iOS Keyboard Leak – Input Methods Expose Clipboard in iOS 18Third-party keyboard extensions in iOS 18 can read clipboard contents without user consent, violating the sandbox boundary.2026-03-20
- iPhone Certificate Validation Bypass – Pinned Trust Anchors IgnoredA flaw in iOS 18 certificate pinning allows MITM attacks against apps that rely on custom trust anchors.2026-03-05
- iOS VPN Leak – Network Extensions Bypass in CVE-2024-44165Network Extension framework allows VPN bypass when Wi-Fi is momentarily disconnected during handoff to cellular.2026-02-18
- iOS Bluetooth Pairing Bypass – BLE Man-in-the-MiddleA BLE man-in-the-middle attack exploits the pairing verification step to hijack connections between iPhone and peripheral devices.2026-02-02
- iOS Baseband Denial of Service – Remote CrashCrafted LTE attach request can crash the baseband processor, rendering iPhone voice and cellular data unusable until restart.2026-01-20
- iOS File System Bypass – Archive Extraction PrivescZip archive extraction in the Files app allows writing outside the sandbox directory via path traversal.2026-01-10
2026 Timeline
- October 2026 — iOS 27 massive security release patches 37 CVEs
- September 2026 — iMessage BlastDoor bypass proven via Pangu
- September 2026 — iOS 26.7.1 patches CoreGraphics zero-day
- August 2026 — macOS 14.7 FileVault key leak exposed
- May 2026 — watchOS 11 enables passkeys on Apple Watch
- April 2026 — Spyware campaign targets 110 countries
About Linen Orbit
Linen Orbit is an independent research publication covering Apple iOS, macOS, and iPadOS security. We track Apple security advisories, NVD entries, CISA alerts, and emerging exploit activity — then produce readable summaries with actionable recommendations.
We are an independent publication. We are not affiliated with Apple Inc. Apple, iOS, macOS, and iPhone are trademarks of Apple Inc.
Contact: hello@linenorbit.com