What happened
CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, after reports of active exploitation. Apple fixed the flaw in May 2024, so this is an old bug being used against devices that never updated. The source report is on The Hacker News.
The flaw is an improper authentication issue. An attacker who already has arbitrary read and write capability can use it to bypass Pointer Authentication. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
The KEV listing follows a Sekoia report. It says threat actors possibly linked to Russia used previously patched bugs in Safari and Google Chrome to deliver malware that harvests browser and device data.
Who is affected and which versions fix it
Apple addressed the bug with improved checks in the releases below. Your devices should be on these builds or later:
| Product | Fixed in |
|---|---|
| iPhone |
iOS 16.7.8 or iOS 17.5
|
| iPad |
iPadOS 16.7.8 or iPadOS 17.5
|
| Mac | macOS Sonoma 14.5 |
| Apple TV | tvOS 17.5 |
| Apple Watch | watchOS 10.5 |
| Browser | Safari 17.5 |
The attacks also touch Chrome. Browsers on any platform should be on the current release.
Severity and active exploitation
The CVSS score is 5.5, which is medium. Do not let that number lower your guard. Active exploitation is the reason CISA listed it.
The activity is attributed to APT29, also known as Cozy Bear and Midnight Blizzard. It is a state-sponsored group tied to Russia's Foreign Intelligence Service. The attribution carries "moderate to high confidence."
There are three initial access paths:
- Compromised legitimate websites.
- Fake sites that copy popular websites.
- A supply chain attack aimed at Plerdy SEO Tracker.
Each path serves malicious JavaScript that triggers the vulnerability. The code profiles the visitor's device first, then deploys an information-stealing payload. The zero-click exploit chain pairs CVE-2025-43529, a WebKit remote code execution flaw, with a pointer authentication bypass. It runs a JavaScript payload built for browser cookie theft.
What to do now
CISA recommends that Federal Civilian Executive Branch agencies apply the necessary patches by November 18, 2026. Private teams can use the same date as a sensible target.
1. Update every Apple device and browser
On iPhone and iPad, open Settings, then General, then Software Update. On a Mac, check the build and install updates from the terminal:
sw_vers
softwareupdate --list
sudo softwareupdate --install --all
Check the Safari version separately, since it may ship apart from the OS:
defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
2. Check your fleet
If you run osquery, these two queries list macOS and Safari versions. Compare the output with the table above.
SELECT name, version, build FROM os_version;
SELECT name, bundle_short_version FROM apps WHERE name = 'Safari.app';
3. Look for the Plerdy tracker on your own sites
The supply chain path targeted Plerdy SEO Tracker. If you publish websites, search your code and templates for it:
grep -ril "plerdy" /var/www/
A hit does not prove compromise. It tells you to review the script source and compare it with the vendor's official copy.
4. Treat stolen cookies as the real risk
The payload is built to steal browser cookies. On a device that ran an old build, sign out of sensitive web accounts and revoke active sessions. Rotate passwords for anything high value.
Worked example: 20 Macs, mixed ages
Say a small office has 20 Macs. You run the osquery check and find 3 on a build older than macOS Sonoma 14.5.
| What you find | Action |
|---|---|
| Build older than the fixed release | Update today and restart |
| Fixed build, old Chrome | Update Chrome and relaunch |
| Device can't take the update | Retire it or keep it off sensitive accounts |
| Staff browsed unknown sites on an old build | Revoke sessions and rotate passwords |
What IT and security learners can take from this
This case shows why patch status matters more than a severity score. A medium bug became a state-backed attack tool. It also shows why asset inventory, version checks and session revocation are core defender skills. If you want to build those skills toward a recognized credential, the CompTIA CySA+ CS0-003 voucher covers threat analysis and vulnerability management. For a related case on stolen credentials, read our post on fake GitHub security tools that push infostealers.
Browse more options in our cybersecurity certification category. Vouchers arrive by email within 12 hours.
Originally published at BuyExamVouchers.
Top comments (0)