Years-Old Apple Pointer Authentication Bypass Back in Active Use for Espionage-Linked Malware Delivery (CVE-2024-27834)

Scope: Older Apple devices and browsers on builds predating the May 2024 security updates (iOS/iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, Safari 17.5)

Severity: Amber

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, 2026, following a report from security firm Sekoia that threat actors possibly linked to Russia have been exploiting this previously patched flaw, alongside a related Chrome vulnerability, to deliver information-stealing malware capable of harvesting browser and device data. The flaw itself is not new, Apple fixed it in May 2024, but the campaign using it is current and ongoing, demonstrating that attackers continue finding value in older vulnerabilities against any device population that never applied the fix. The attackers use three separate initial access routes to reach victims: compromised legitimate websites, fake sites built to impersonate popular services, and a supply chain attack against Plerdy, an SEO tracking tool, used to serve malicious JavaScript that triggers the vulnerability after profiling the visitor’s device. Federal agencies have until November 18, 2026 to apply the necessary patches, a comparatively generous window reflecting that this is a known, long-available fix rather than a fresh emergency. Organisations and individuals should confirm that Apple devices and Safari installations are running builds from May 2024 or later, and anyone still on an older build should update immediately given the confirmed active campaign now targeting exactly that gap.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.