Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- It would be so nice to see how many zero-days are going away for bad players right now.
- Apropos, anyone else saw "fast user switching" in Tahoe turn into "excruciatingly slow user switching which after a minute of switching without success rebooted the whole damn machine"?by FabHK
- Questions about current version macOS Tahoe 26.5.2 I am noticing that some tabs when clicked or gadgets when oppened, they blink? has anyone experienced this?
- Collision counts are absurd. CVE-2026-43739 has roughly twenty credited researchers; CVE-2026-43816 has nearly as many. And ai attribution getting credit.by nizbit
- One CVE even lists the same person twice!
CVE-2026-64691: Ruslan Dautov, Ruslan Dautov
by croemer - This may be a naive take, so if anyone has insight please feel free to share, but across Windows, Mac, and Linux OS's I see many cases of path parsing vulnerabilities resulting in sandbox escapes, code execution, or data access issues. When presenting the user with a file picker or command-line input, is it really needed that the software can handle the full POSIX spec?
I do not see a "typical" user needing to access a path with say a network storage but multiple ../.. and hard and soft symlinks simultaneously. I think "be liberal in what you accept" might need to be revisited for path parsing with some sort of OS-wide single-implementation as an optional feature.
by TheJoeMan - How would you enforce a single implementation of path parsing?
- > I do not see a "typical" user needing to access a path with say...
Typical users run software written by atypical users.
> some sort of OS-wide single-implementation
How do you propose handling migration? What if someone tries to expand an old archive file containing a now-forbidden path?
by acuozzo - Weird thing to see at number 3 on HN - is there some subtle context I am missing here?
Are we wink winking that it's a lot of fixes?
by AJRF - I think that's it?by croemer
- Yes, it's really quite a lot https://9to5mac.com/2026/07/27/ios-26-6-fixes-over-75-securi...by Tepix
- I think it's because it's the first big batch of fixes found at Apple by Mythos.by cromka
- Relevant context might be for example that there are 4 mentions each of Claude by Anthropic and XGPT by ThreatBook, both based on LLMs.
AI attribution might be one reason people are particularly curious.
by DStiego - And it's not actually that much information "about the security content". For example: "Impact: An app may be able to access sensitive user data. Description: An access issue was addressed with additional sandbox restrictions." This references CVE-2026-43819, which doesn't have any more information. Compare this with the nearly decade-old https://support.apple.com/en-gb/103680, and you see much more specific information about problems and their remedies (except in situations where Apple's action was to update a vendor component).by grahamlee
- It is a lot of fixes and the Android Security Bulletins of June and Android 17 also had a lot of fixes [1], despite ASBs only containing high/critical vulnerabilities (other vulnerabilities are only fixed in major releases and QPRs, which most Android vendors respectively roll out late or never at all).
I think the story here is that vulnerability discovery has accelerated a lot with LLMs, but since are adversaries are doing the same, it is more important than ever to update quickly (and not let some Android vendors get away with their lazy update schedules).
[1] https://source.android.com/docs/security/bulletin/2026/2026-... https://source.android.com/docs/security/bulletin/android-17
by microtonal - Lots of "in collaboration with Claude and Anthropic Research" mentions, no mentions of other labs. I'd assume Apple already had access to whatever the most powerful model is at the various US-based labs, but perhaps not?
- also “ Using GLM From Z.AI”by claiir
- Apple also hosts a copy of Claude internally in their servers.by senadir
- > Lots of "in collaboration with Claude and Anthropic Research" mentions
I wouldn't say 4 is lots. The entire list is massive. I haven't counted myself, but someone claimed that macOS 26.6 has the all-time record with 155 CVEs.
by lapcat - Apple isn’t friends with OpenAI anymoreby tombot
- Those were voluntary disclosures by two Anthropic researchers and the security firm Calif. I know one more CVE on the list that was discovered using an AI agent and wasn't disclosed as such. I suspect there are many more.
- Map the amount of fixes with "... improved bounds checking...", "...improved memory handling...", "...improved memory management..." into the amount of developer, QA and release management teams salaries per hour, versus other stuff they could be working on, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.by pjmlp
- “nah bro, all those other developers are just garbage, I am the one person that can write memory safe C”
- If anything, there's a strong argument to switch to seL4.by snvzz
- >>, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.
You need also factor development time and ease of finding developers willing to work in a specific language. There are other factors like readability of the code (very verbose languages are likely to be worse) and cost of maintenance - languages forcing a lot of abstractions are likely much worse.
by bluecalm - 15.7.8 is out today as well, with these security fixes: https://support.apple.com/en-us/128071.
For context, there have been issues with MacOS 26 which have led many people to defer upgrading until MacOS 27 is available, and MacOS 15 is the previous version.
by tengwar2 - Did they un-hardcode the corner radius? I mean were they able to? I mean not that that anyone at this point needs convincing how utterly disgusting incompetent they’re at software.
- Are there no versions between MacOS 15 and 26???by carra
- 26.0 had a very annoying video jitter issue, but that was the first things that I noticed to be fixed in the next 26 release. Other than that, it worked just fine.
- >have led many people to defer upgrading until MacOS 27 is available
Then there's me, crying in MacBook Pro 2019 stuck on MacOS 15 because 27 won't be available for my machine.
by reddalo