Our next macOS Vulnerability Researcher trainings with @gergely_kalman will be: 📆 2026-10-12 - 15: Self-organized, 4 (!!!!) day training (Budapest, Hungary) 📆 2026-11-15 - 17: Objective by the Sea v9 (Hawaii, USA) More info here: macosvuln.training/

I got assigned 5 new 🍎 CVEs. Update your boxes. apple-cve.com/ also contains the latest advisory updates.

Apple has just released updates to Golden Gate 27.2, 26.7.2. and 15.8.2 eclecticlight.co/2026/10/26/… via @howardnoakley

🎶🎼🎤🎵

Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01) 223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence. Published on: blackstormsecurity.com/resea… This article will be published on exploitreversing.com/ next week. I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support. Hope you enjoy the read! #iOS #Apple #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering

Using process coalitions in the XNU kernel to benefit incident response process trees. A short writeup on some updates I made to the TrueTree project themittenmac.com/blogs/proce…

🍎 💾 Link to my slides and talk recording "macOS Mounting Madness" is up on my site: theevilbit.github.io/talks/

Shoutout to our Principal Security Researcher, @theevilbit , for the 56 vulnerabilities he submitted that put Iru on the board of the top 10 companies reporting CVEs in Apple.

#OBTS v9.0 is officially SOLD OUT! 🎉🌴 Registration is now closed, but if you're still hoping to join us in Maui, get on the waitlist! 📩 waitlist@objective-see.com A few spots usually open up as the conference gets closer, so there's still a chance! 🤞

Not sure what to watch tonight? Pick a session from the Top 5 List at MacSysAdmin Conference 2026. Platform SSO - All Grown Up! From Zero-Touch to Zero-Trust Orchestrate Your Deployment Infrastructure as… Claude? You’re Not Home Alone macsysadmin.se #msa2026

🗒️ Recipe: @gergely_kalman + @theevilbit + ☕️☕️☕️☕️☕️ = 🎉New vulns Every. Single. Time. 😱

🏝️ 🌺 🌊 Do you want to spend 3 days (or 6) in this location? Do you have some year-end budget left that you need to spend? Fear no more! We got you covered with @gergely_kalman ! Just come to our "macOS Vulnerability Researcher" training, which will be at Nov. 15th - 17th, in Maui, Hawaii. Then stay for the conference. ➕ As a side effect: you will gain a ton of macOS knowledge with the likelihood that you will find some cool 0days after, and earn 💰 ➕ ➕ Bonus: You will have a chance to meet some of the best minds of the macOS attack and defense space at the conf. We only have a few spots left, so don't overthink it, just sign up. More info here: objectivebythesea.org/v9/tra…

Microsoft macOS devs should take our macOS exploitation training with @gergely_kalman . 🤪 We have a few places left for our Hawaii 🏝️ training. Just saying. Submitted a macOS LPE to MSRC. 🍿

🍎 Closing the week strong, with a 💻 chain: 1️⃣ App TCC bypass -> allows modifying NIB files 2️⃣ DirtyNib reborn without user interaction -> Inject to any* GUI app 3️⃣ Get more TCC bypass + Full LPE ⏭️ Hunting for more privs *non launch constrained

Open-sourced CryptSn0w, our now obsolete untethered iOS ≤27/≤A20 Pro jailbreak via rare Apple server-side TSS/Cryptex bug. PATCHED, educational only. NOT a working jb Built w @GenericCoding @D4RK7ET. SBInject: @htrowii. Help: @Jakeashacks @forcequitOS github.com/0xjohnnydev/crypt…

✔️ It's a wrap! We are done with our very first 4 day version of our macOS Vulnerability Researcher training with @gergely_kalman Lot of jaw dropping moments, sometimes even for us. 🙈 At the moment we don't know when we will do another 4️⃣ day again.

Iru TI finished off September strong! Cristian posted a blog breaking down PamStealer and Csaba put in overtime applying pressure to Apple. Excited for what's next to come 👀 iru.com/blog/pamstealer

Seventeen years later… The time has come for Machinarium 2 🦾🔧 Wishlist NOW on Steam.

We are happy to announce that we have updated our AppleTV-app, our web archives, and our YouTube channel with this year’s sessions. Enjoy! macsysadmin.se #msa2026

🍎🫜 macOS Teaser: Sandboxed user to root LPE.