CISA added Apple WebKit flaw CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, based on evidence of active exploitation. Apple fixed the bug in May 2024, so any iPhone, iPad or Mac that is up to date is already protected. The risk is for devices that never installed the fix. The same day, security firm Sekoia published a report describing a Russia-linked watering-hole campaign that used this exact flaw against older iPhones.
What CISA has confirmed
The KEV entry is titled “Apple Multiple Products Improper Authentication Vulnerability.” It was added on November 4, with a due date of November 18, 2026 for US federal civilian agencies. The listed action is to apply the vendor’s mitigations. CISA lists known ransomware use as “Unknown.” Its alert gives no detail on who is exploiting the bug or how. The deadline applies to federal agencies only, but CISA encourages every organization to treat KEV items as priorities.
What the flaw is
Apple describes CVE-2024-27834 as a WebKit issue in which an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Pointer Authentication is a hardware-backed defence that makes memory-corruption attacks harder. By itself the bug does not let an attacker into a phone. It matters as one step in a longer chain of exploits. The flaw was credited to Manfred Paul, working with Trend Micro’s Zero Day Initiative.
Apple’s security notes for iOS 17.5 and iPadOS 17.5, released May 13, 2024, list the fix. The same fix shipped in iOS 16.7.8, Safari 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, according to a Rescana summary of the listing. Apple’s security releases page shows iOS 27.2 and iPadOS 27.2, released October 26, 2026, as the current versions.
The Sekoia report
Sekoia’s “Poisoned Source” report describes a large watering-hole campaign: visitors to compromised or lookalike websites were quietly fingerprinted, and only matching devices received exploit code. Sekoia says CVE-2024-27834 is the pointer-authentication bypass in one of three exploit chains. That chain targeted iPhones on iOS 16.7 and aimed to steal browser cookies. A second chain went after iOS 18.5 to take broader device data, and a third used an Android Chrome flaw to take Chrome cookies and saved Wi-Fi passwords.
The delivery routes, according to Sekoia, were scripts injected into compromised sites, reverse-proxy lookalike domains, and a roughly one-week compromise of the Plerdy analytics script between August 27 and September 3, 2026. Sekoia says the compromised sites included a US chemical-industry trade association and a Ukrainian gas production company, and that lookalikes imitated America250 and a London hotel. It says victims were spread across Europe and the US, with a focus on Ukraine.
On attribution, Sekoia writes that it assesses “with moderate to high confidence” that the campaign was run by APT29, a group widely linked to Russia’s foreign intelligence service. That is a researcher’s assessment, not a government finding. Sekoia also notes that all of the flaws had vendor fixes before the campaign began.
What to do
- Update your iPhone or iPad. Open Settings, then General, then Software Update, and install the latest release. Apple lists iOS 27.2 as current.
- Check older devices. The Sekoia chain filtered for iOS 16.7, a version still found on phones that cannot run newer releases. If a device is stuck on an old version, treat it as higher risk, avoid sensitive logins on it and consider replacing it.
- Update Macs and Safari. macOS Sonoma 14.5 and Safari 17.5 or later include the fix.
- Update Android and Chrome. Sekoia’s Android chain used a Chrome flaw and a Qualcomm Adreno driver flaw, both already fixed by their vendors, so current updates cover them.
- IT teams: use device management to find and block phones and laptops below a minimum OS version. Site owners: review third-party scripts, since one analytics provider was used as a delivery route.
What is still unknown
- CISA has not said whether its listing is based on the Sekoia campaign or on separate evidence.
- No victim count has been published. Sekoia says it is working with national response teams in the affected countries to identify victims.
- Sekoia says it is unclear how the attackers obtained the exploits, which resemble those used by commercial surveillance vendors.
This article is general information on public advisories, not a security assessment of any particular device or network.
Sources
- CISA Known Exploited Vulnerabilities catalog, CVE-2024-27834
- CISA alert, November 4, 2026
- Apple, security content of iOS 17.5 and iPadOS 17.5
- Apple security releases
- Sekoia, Poisoned Source report, November 4, 2026
- Rescana, CVE-2024-27834 summary
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
