Post B4bOvDPZM6GBSDDL04 by mttaggart@infosec.exchange
 (DIR) More posts by mttaggart@infosec.exchange
 (DIR) Post #B4bOvCvRA89nwl7H28 by gknauss@mastodon.social
       0 likes, 0 repeats
       
       Apparently, Apple isn’t going to patch iOS 18.6.2, meaning I either risk my information with DarkSword or my sanity with iOS 26.Say what you want about Microsoft — please! use profanity! — but they wouldn’t let a zero-interaction, full-exfil bug go unfixed on a seven month old release.
       
 (DIR) Post #B4bOvDPZM6GBSDDL04 by mttaggart@infosec.exchange
       0 likes, 0 repeats
       
       @gknauss Hey! Do you have a source for this?
       
 (DIR) Post #B4bOvDjm8yQISsfTUm by gknauss@mastodon.social
       0 likes, 1 repeats
       
       @mttaggart Nothing explicit, but reading between the lines…iOS 26 has been fixed. iOS 18 for devices that can’t run iOS 26 has been fixed. And those who can run iOS 26 but don’t want to? [Conspicuous silence.]https://www.wired.com/story/hundreds-of-millions-of-iphones-can-be-hacked-with-a-new-tool-found-in-the-wild/
       
 (DIR) Post #B4bOzQSQnAdB4fYoCG by mttaggart@infosec.exchange
       0 likes, 0 repeats
       
       @gknauss I think the thing is to move to 18.7.3, which is patched.For devices running versions of iOS prior to 18.6, DarkSword uses CVE-2025-31277, a JIT optimization/type confusion bug which was patched by Apple in iOS 18.6. For devices running iOS 18.6-18.7, DarkSword uses CVE-2025-43529, a garbage collection bug in the Data Flow Graph (DFG) JIT layer of JavaScriptCore which was patched by Apple in iOS 18.7.3 and 26.2 after it was reported by GTIG. Both exploits develop their own fakeobj/addrof primitives, and then build arbitrary read/write primitives the same way on top of them.I'm unaware of a compelling reason or hardware limitation to not upgrade from 18.6 to 18.7https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/
       
 (DIR) Post #B4bOzQeU4MGvg3CQz2 by gknauss@mastodon.social
       0 likes, 0 repeats
       
       @mttaggart 18.7.X isn’t offered to me, since I’m on a iPhone 15 Pro.  It’s either up to 26 or staying at 18.6.2.
       
 (DIR) Post #B4bOzQlvcgE838gNaS by mttaggart@infosec.exchange
       0 likes, 0 repeats
       
       @gknauss Ah I see, and you'd rather not run into the Liquid Glass ceiling. That does seem to be an issue!
       
 (DIR) Post #B4bOzQun5jJeUcpSOu by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @mttaggart @gknauss same for SE 2022 (funnily, my SE 2016 does get patched…)
       
 (DIR) Post #B4bP3UHqUrti6oXugS by jsnell@zeppelin.flights
       0 likes, 0 repeats
       
       @gknauss worse, it’ll patch it, just not for phones that can run 26
       
 (DIR) Post #B4bP3USpq0gietggoS by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @jsnell @gknauss @mttaggart call customer support and file one at https://www.apple.com/feedback/iphone/if they get even 10 million requests, maybe they begin to think