Most security bulletins are about the newest bug. This one is about a bug that is two and a half years old. On Nov. 4, the Cybersecurity and Infrastructure Security Agency added CVE-2024-27834, an Apple flaw that lets an attacker bypass pointer authentication, to its Known Exploited Vulnerabilities (KEV) catalog. Apple fixed it in May 2024. Federal civilian agencies now have until Nov. 18, 2026 to make sure it is patched everywhere.

The timing matters more than the bug itself. As The Hacker News reported, the KEV addition came after a report from the French security firm Sekoia describing a campaign that exploited patched Safari and Chrome flaws. Sekoia links that campaign, with moderate-to-high confidence, to APT29, the Russia-linked group. Help Net Security reports that Sekoia says every flaw in the campaign's exploit chains had been fixed before it began, and that a user on an up-to-date operating system is safe from these attacks. The takeaway for defenders is simple: if Sekoia's attribution is right, a state-backed group is getting results from bugs that were fixed long ago. Phones and browsers that stopped updating are the target.

What the bug actually does

Pointer authentication is a hardware security feature in Apple's chips. A pointer is a memory address that tells a program where to find code or data. Pointer authentication attaches a cryptographic signature to important pointers and checks it before the pointer is used. If an attacker has corrupted memory and tries to send the program somewhere it should not go, the signature check fails and the attack stops. It is one of the main reasons that turning a memory-corruption bug into working code execution on a modern iPhone is so hard.

CVE-2024-27834 removes that protection. CISA's catalog entry, which files the bug under "Improper Authentication" (CWE-287), says it lets "an attacker with arbitrary read and write capability" bypass pointer authentication. The important condition is that the attacker already needs to be able to read and write memory freely. On its own, this bug does not get anyone onto a device. It is the piece of an exploit chain that turns a first foothold into something useful. That explains why the NVD record gives it only a 5.5 "Medium" CVSS 3.1 score, with a local attack vector and low privileges required. Taken alone it looks modest. Inside a chain, it does real work: Help Net Security says that on iPhones running iOS 16.7, the attackers chained CVE-2025-43529 with CVE-2024-27834 to steal cookies.

Apple's security content page for Safari 17.5 lists the bug as a WebKit issue, WebKit being the browser engine behind Safari and every browser on iOS. It credits Manfred Paul (@_manfp), working with Trend Micro's Zero Day Initiative. According to The Hacker News, the vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024. Apple shipped fixes two months later. NVD lists the fixed releases as Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.

CISA's entry does not name an attacker, and it lists known ransomware use as "Unknown." It cites Apple support pages 120896, 120898, 120901, 120902, 120903 and 120905, along with Binding Operational Directive 26-04.

The campaign behind the timing

Help Net Security summarized Sekoia's findings. Sekoia's Threat Detection and Research (TDR) team spotted the operation in mid-October 2026. It is a watering-hole operation, meaning the attackers compromise websites their targets are likely to visit instead of sending phishing emails, and then wait.

Sekoia described three ways the malicious code reached visitors:

  • Injected JavaScript on legitimate websites. The victim sites Help Net listed include a Ukrainian gas producer, a U.S. chemical industry trade association, a far-right European political party and a Bulgarian military-related organization.
  • Lookalike domains that worked in an adversary-in-the-middle style, imitating real sites. The examples given were an America250 lookalike and a clone of a London luxury hotel's site.
  • A supply-chain compromise of Plerdy, a Ukrainian web analytics service, between Aug. 27 and Sept. 3. Because analytics scripts are loaded by every site that uses them, compromising one provider puts code in front of visitors to all of its customers' sites at once. Help Net says the script runs on thousands of websites, most of them Ukrainian.

Visitors then received exploit chains matched to their platform, targeting iOS and Android devices with n-day exploits. An n-day is a bug that has already been publicly disclosed and patched, as opposed to a zero-day that nobody has fixed yet. According to Help Net, the payloads stole cookies, messages and Wi-Fi passwords. Stolen session cookies are especially valuable because they can let an attacker into a victim's accounts without ever needing the password or getting past multi-factor authentication.

A note on attribution: the APT29 link is Sekoia's assessment, made at moderate-to-high confidence. Help Net reports that it rests on traces of a 2025 APT29 watering-hole operation found on one of the compromised sites, similarities to a 2024 APT29 campaign against Mongolian government websites, and a victim list centered on Ukraine. APT29 is also tracked as Midnight Blizzard and Cozy Bear and is tied to Russia's SVR foreign intelligence service. Treat the attribution as one credible firm's analysis, not as established fact.

Why old bugs still work

Sekoia's own conclusion is that packaged n-day exploit chains lower the cost and technical threshold of advanced mobile exploitation. That fits the economics: a working iPhone zero-day chain is expensive to build or buy and loses its value once it is discovered, while an n-day still works on every device that missed the update. That population is larger than many IT teams assume: phones abandoned by their manufacturer, personal devices that never got the prompt to update, kiosks and shared tablets that nobody owns, and Android devices whose vendors delivered patches late or not at all.

Watering holes add another problem for defenders. The visit itself looks normal. Someone at a chemical company reading their trade association's website, or a contractor checking a hotel booking, is not doing anything a security awareness course would flag. The attack depends entirely on what the visitor's device fails to block.

What It Means for Defenders

Who is exposed: Any Apple device running releases older than the fixes listed above, and any iPhone or Android device that has fallen behind on browser and OS updates generally. The campaign targeted both mobile platforms, and The Hacker News reports that the underlying exploitation involved patched Safari and Chrome flaws. Sekoia noted that several of the compromised sites are likely to attract high-value visitors in the context of the Russia-Ukraine war, but it said it was unclear whether specific visitors were targeted or whether the attackers sought as many unpatched devices as possible, and a supply-chain compromise of an analytics script does not pick its victims carefully.

What to patch:

  • Make sure Apple devices are at or above Safari 17.5, iOS 17.5 / iPadOS 17.5 (or iOS 16.7.8 / iPadOS 16.7.8 on older hardware), macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, according to NVD. In practice, the current supported release is the right target, since devices still sitting at 2024 builds are missing far more than this one fix.
  • Federal civilian agencies must remediate by Nov. 18, 2026, per the KEV entry. Contractors and private organizations are not bound by that date, but it is a sensible deadline to adopt.
  • Find the devices that cannot be updated. Use MDM reporting to list every phone and tablet below current OS levels, and decide whether out-of-support hardware should be retired or cut off from corporate email, SSO and VPN.
  • Update Chrome and other browsers on Android, and confirm that Android devices are getting their vendor's security updates.

What to check and rotate: Because the payloads stole cookies, messages and Wi-Fi passwords, a device suspected of compromise should be treated as having leaked its active sessions. Revoke sessions and refresh tokens for its accounts, rotate the Wi-Fi credentials it had saved, and check identity provider logs for sign-ins from unfamiliar locations that reuse existing sessions. If your organization runs public websites that load third-party analytics or marketing scripts, review which outside JavaScript you serve and who controls it. The Plerdy compromise is a reminder that your site can become someone else's watering hole.

For CMMC shops: Mobile devices that touch Controlled Unclassified Information fall under the same configuration-management and flaw-remediation expectations as laptops. An outdated personal iPhone with corporate email on it is the kind of gap this campaign was designed to find.

Sources