Georgy Kucherin

A supply chain attack compromised official installation packages distributed via the legitimate website daemon-tools.cc between April 8, 2026, and May 5, 2026. Attackers accessed the build or distribution infrastructure of the vendor, AVB Disc Soft, to trojanize three binaries: `DTHelper.exe`, `DiscSoftBusServiceLite.exe`, and `DTShellHlp.exe`. Because these files were signed with a legitimate code-signing certificate, they could bypass signature-based detection. This issue involves dangerous undeclared capabilities that may allow a remote attacker to bypass existing security restrictions.

An issue exists where an app may be able to modify sensitive kernel state due to a memory out-of-bounds operation. The flaw involves the use of undocumented MMIO (Memory-Mapped I/O) registers in Apple SoCs, which allows attackers to bypass hardware security protections and manipulate protected kernel memory to gain full control of the device. This issue was part of a campaign known as Operation Triangulation, where attackers could deliver a malicious iMessage attachment to compromise a device without any user interaction. There are reports that this issue was actively exploited against iOS versions released before iOS 15.7.1.

An integer overflow occurs due to insufficient input validation, which may allow an application to execute arbitrary code with kernel privileges. An integer overflow is a condition where an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of bits. This issue has been reported as actively exploited against versions of iOS released before iOS 15.7. In real-world incidents, this flaw was used as part of a sophisticated spyware campaign to gain root privileges on target devices, enabling the deployment of a backdoor for stealing iCloud keychain data, recording microphone audio, and tracking location.

This vulnerability is a memory corruption issue within WebKit, potentially allowing arbitrary code execution. The issue stems from improved state management and has been reported as actively exploited in the wild against iOS versions released before iOS 15.7. The vulnerability affects multiple Apple products, including Safari, iOS, and iPadOS, as well as WebKitGTK. The root cause involves a memory corruption issue within WASM due to allowing moving of not fitting offsets into instruction.

The issue is related to the processing of font files, which may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1. The vulnerability is associated with a buffer overflow in the FontParser component of Apple's operating systems. It is estimated that a large number of devices may be affected, but the exact number is not specified. The issue was addressed with improved handling of caches.