Exploring the world with my sword of debugger : )
Joined August 2013
- Tweets316
- Following282
- Followers5.4K
- Likes3.7K
Mickey Jin retweeted
Apple has patched a vulnerability I reported that had been present for over a decade. The fix was released in macOS 27.2.
CVE-2026-112445
Of all the local privilege escalation (LPE) vulnerabilities I’ve seen, this is probably the easiest to exploit, the most straightforward, and the most bizarre—so bizarre that it makes you wonder whether it was an Apple backdoor.
github.com/Mas0nShi/CVE-2026…
In the AI era, the list will be updated frequently. I’m gradually stepping back to devote myself fully to my new baby.
Cool 👍
🍎🐛 I got Claude making this, maybe it's useful for others as well.
Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.
apple-cve.com/
Mickey Jin retweeted
I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)
- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉
Try it here: github.com/jprx/darwin-vm
Empty vessels make the most noise.
Barking dogs seldom bite.
CVE-2026-28910 just saw the CVE information has been updated. Im the first one who found this vulnerability, on 5/8/25, five months before you did. And the impact was underestimated, it could do more things than your PoC.Easily weaponized. Keep calm. Your post made it sound like I had stolen your research. If you wanna verify the timing of other reports, DM them instead of doing something like this. Not geeky.
Mickey Jin retweeted
The screensharingd bug is a pre-auth, and an amazing bug that LLM enabled clowns killed without understanding it. Releasing a PoC that allows to download files from vulnerable macOS. It’s not super reliable, but the real one is very much. Patch asap!
reverse.put.as/2026/07/29/it…
After reading @lateralusd_ blog:
ns-echo.com/posts/cve_2023_4…
I found the same bug that you found here, and then I reported to the ZDI.
Finally, it was disclosed as 0-day:
zerodayinitiative.com/adviso…
Mickey Jin retweeted
🍎🌁 Big changes to user TCC.db in macOS Golden Gate! It seems that it finally got the protection it deserves.
It was moved to:
/private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/
You can't access it even with FDA, and likely need "com\.apple.private.security.protected-system-container" entitlement to write to it.
Mickey Jin retweeted
Some observations from disassembly that might be related to iOS 27 performance boost
codecolor.ist/posts/2026-06-…
Mickey Jin retweeted
IMO Mysk is not trustworthy. They tried to hype low impact vulns as critical in the past (HTTP icon download). Also... duplicates happen, and Apple always credits you for those. If you can't trust the vendor's decision about first submitter, then don't submit. I did cross check a few of these duplicates with researchers in the past, and Apple was always right.
Maybe the trick of social engineering is the vulnerability here. But you can get access to any protected file (not only the plist file) by convincing the victim to drag&drop.
The CVE-2026-28910 requires the access to a protected plist file first, this shouldn’t be considered as a real vulnerability, in my humble opinion.
This one is similar to my CVE-2026-20633, patched in macOS 26.4 too. However, my bug doesn’t require any user interaction. I can’t disclose the details right now because I have already submitted a bypass report 🫣