A defence should hold when the attacker knows everything except the key. For Apple's platforms, the "key" in practice is the update state of the device. The evidence for late October to early November 2026 points to one conclusion. Exposure depends less on whether a flaw is known or fixed than on whether the device in someone's hand has absorbed the fix. Two further stresses point the same way. The setting Apple presents as its strictest has reportedly been bypassed. And a privacy policy is changing in ways that users must take on trust.
A fixed flaw becomes a live threat
CVE-2024-27834 is a WebKit Pointer Authentication bypass that Apple patched in May 2024 15,22,27. On November 4, 2026, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog 17,27,39. The flaw is not newly discovered 39. Its CVSS v3.1 base score is 5.5 5,17,22,24,27,38, a Medium rating 17,22,24. U.S. federal civilian agencies must act by November 18, 2026 17,27. Sources disagree on the governing directive. One ties the deadline to BOD 22-01 17, and another cites BOD 26-04, "Prioritizing Security Updates Based on Risk" 17. They agree on the date.
The modest score and the operational reality seem contradictory until you look at what the bug does. It lets an attacker who already has arbitrary read and write ability circumvent Pointer Authentication defenses 24, by reading a device-specific value 27. It does not allow code execution on its own 27. Its value lies in chaining: combined with other initial-access vulnerabilities, it allows tampering and persistence 27.
A scoring system that rates the component in isolation will understate its worth to someone building a chain. That is my interpretation. The sources do not state it as such. The EPSS evidence is no help in settling the matter. One X post gives 1% 33, while a source dated November 5, 2026 places the flaw in the 72nd percentile 17. The two figures are framed differently, and the material does not reconcile them.
How the chain is being used
Public reporting on exploitation rests mostly on Sekoia, which appeared on November 4, 2026 27 and reportedly prompted the KEV addition 24. Each of the following claims is single-sourced in this material:
- Attackers pair CVE-2024-27834 with CVE-2025-43529, a WebKit remote code execution bug 24. This is described as a zero-click exploit chain 24.
- The activity is attributed to APT29 with moderate-to-high confidence 38,39.
- The chains deploy info-stealing malware 22 that harvests browser cookies and device data 38.
- Reported entry vectors include compromised legitimate sites 39 and a supply-chain compromise of the SEO measurement tool Plerdy 39.
Several limits apply. The scale of the attacks is still being confirmed 39. CISA did not disclose exploitation details 27. The "zero-click" description sits awkwardly beside the compromised-site vectors, and the material does not explain how the two fit together. The delivery mechanics therefore remain unclear.
The wider campaign is better corroborated, and it shows CVE-2024-27834 as one part of a larger operation. Malicious JavaScript on compromised sites probed visitors' devices before triggering the flaw 24. Attacks on iOS 16.7 targeted browser and app cookies 16,19. The iOS 18.5 chain is tied to DarkSword 19. Once it gained higher-level access, it could collect SMS messages 19, WhatsApp and Telegram databases 19 and Keychain information 19. On Android, Chrome flaws were combined with a Qualcomm Adreno GPU driver flaw to run an info-stealer called AndroSnitch 19. The Chrome Android attack used CVE-2026-3910 19.
Attribution is weaker than the technical detail. Many APT29 references come from individual social-media posts 10,31,32. One source calls the group "suspected" 26. Google's Threat Analysis Group reported in 2024 that APT29 had compromised Mongolian government sites to plant iPhone and Android Chrome exploits 26. That fits the pattern but does not confirm this campaign.
The remediation gap
The fix is old and well documented. It shipped on May 13, 2024 27 in iOS 16.7.8 24, macOS Sonoma 14.5 24, tvOS 17.5 24, watchOS 10.5 24 and Safari 17.5 24. Yet Sekoia said every exploit chain it analysed relied on vulnerabilities Apple and Google had already fixed 19. The people at risk were those on devices that had not been updated 19. One post notes the flaw is still being used roughly 18 months after Apple's patch 34.
There is a tension in the evidence. Sekoia also notes that exploited vulnerabilities include already-patched ones running on the latest OS 27. That points either to a gap between patch availability and adoption, or to attackers chaining the old flaw with newer bugs. The material does not say which.
Lockdown Mode and the question of persistence
Apple describes Lockdown Mode as extra protection for people who could be targeted by highly sophisticated spyware 6,29. It restricts many message attachments and certain web technologies 29. Its premise is that a restricted attack surface holds up even against capable adversaries. This is the claim that November's reporting tests.
In October, Calif.io, a security team that includes Stefan Esser 23, presented an untethered jailbreak for versions up to iOS 27.0.1 23. The team said "most" of the bugs used were fixed in iOS 27.2 23. On November 3, Calif reportedly showed a bypass on an iPhone 18 Pro with Lockdown Mode enabled 29. The attack used a malicious PDF sent over AirDrop 6,12. After the device was updated to iOS 27.2, the jailbreak remained 6,12. The team had installed 27.2 on a device that was already modified 29. A Bluesky post also says root privileges survive the update 11. The result challenges the premise of Lockdown Mode as Apple's strictest setting 12.
The evidence has clear limits:
- A jailbreak that survives an update is not the same as one that can be installed on a device already running 27.2, and it is not clear that Calif's can be 6.
- The exact steps are unknown 6, and it is unclear why Lockdown Mode apparently did not help 23.
- GadgetChecks did not reproduce the jailbreak 29. One article says iOS 27.2 presumably patched the actual attack surfaces 23, so that question is unresolved.
- Esser told Heise there would be no end-user jailbreak tool, though a proof of concept might follow 40.
The "most bugs fixed" statement 23 and the persistence result 23 fit together on one reading. The patches may close the entry points while leaving a foothold that was already placed. That is an inference, not a stated finding. If it holds, it matters because a patch does not retroactively evict an attacker who is already inside. The practical lesson is that updating early matters.
High-risk users and the limits of a warning
Apple's Threat Notifications warn targeted users about state-sponsored or mercenary spyware 1,36,37. Germany's BSI said members of the Bundestag had received such warnings 14,30, and recipients were told to assume their devices may be compromised 14,37. Digital Minister Wildberger confirmed the BSI warning without saying who might be behind it 13, and the investigation is ongoing 37.
The sources disagree on what a notification proves. One quoted article says the alerts show a person may have been targeted, not that spyware was installed 41. That differs from the BSI's assume-compromise advice. It is also not confirmed that every notification came from a zero-click attack 36. John Scott-Railton warned that not receiving a notification does not rule out infection 35. Apple says genuine alerts never ask users to tap links, install apps or provide verification codes 36.
A trust question: scanning public iCloud links
The best-corroborated development in this material is a policy change, not an exploit. Apple's checks of public iCloud links for harmful content begin with iOS 27.3 3,4,7,8, which is still in beta 2,25. The scope is deliberately narrow: items shared as "Anyone with the link" 3.
The dispute is over what this says about encryption. Apple's support page says these items are not end-to-end encrypted even when Advanced Data Protection is turned on 9. Apple and some commentators say the scanning does not weaken end-to-end encrypted private sharing 18. Apple postponed a scanning plan in 2021 after backlash 25. In August 2023, its head of child safety, Erik Neuenschwander, said large-scale scanning of iCloud photos without breaking encryption would lead to large-scale privacy intrusion 25.
Two points in the enforcement guidance are unclear. Apple has reportedly not said what "harmful content" means 21. And the most-cited version of the support document says Apple may "move" flagged content at any time 28, while other reports say it may permanently remove it 20. A system whose rules cannot be inspected asks users to trust it. That fits poorly with a view that protections should withstand scrutiny.
What follows
This section is interpretation, not sourced fact. The evidence does not show that Apple's patching is slow. It shows that patches protect only the devices that receive them, and that a patched entry point does not by itself dislodge a foothold already in place. The KEV listing, Sekoia's account of fixed flaws being used against unupdated devices, and the Calif persistence claim all lead to that reading. The Lockdown Mode result is the most consequential if it holds up. It concerns a current device and the users Apple tells to rely on that setting. It also rests on thin, unreproduced detail. The APT29 attribution rests on one researcher's moderate-to-high-confidence assessment 39.
Takeaways
- Old fixes, new relevance. CVE-2024-27834 was patched in May 2024 15,27 but was added to KEV on November 4, 2026 17, with a federal deadline of November 18, 2026 17,27.
- A chain component, not a standalone threat. The flaw cannot execute code by itself 27, so a Medium CVSS score of 5.5 5,17,22,24,27,38 sits alongside confirmed exploitation. EPSS figures are framed inconsistently 17,33.
- Exposure tracks update state. Every chain Sekoia analysed used already-fixed flaws 19, and the people at risk were on devices that had not been updated 19.
- Lockdown Mode is under question. A reported bypass persisted through iOS 27.2 6,12, but reinstallability and method are unknown 6, and no independent reproduction is cited 29.
- Open questions remain. The attack scale is unconfirmed 39, and the delivery mechanics are not reconciled 24,39.
- The best-corroborated change is a policy one. Public-link scanning arrives in iOS 27.3 4, but what counts as "harmful" is undefined 21.