PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-28825] An Apple Kernel Bug, Brought to You by Microsoft

calif.io | research | CVE-2026-28825 | #vulnerability-research | #apple | #kernel | #xnu | #madbugs | #cve-2026-28825
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# An Apple Kernel Bug, Brought to You by Microsoft Autonomous N-day analysis of CVE-2026-28825. Josh Maine and Bruce Dang April 22, 2026 applemadbugs Contents 1. The setup 2. The vulnerability 3....
CVE
CVE-2026-28825
Published
Collected

Related coverage

research · calif.io
[CVE-2026-64704] Apple MIE Exploitation Challenge
# Apple MIE Exploitation Challenge The first public bypass of Apple MIE on macOS 26.4.1. Dion Blazakis, Bruce Dang, and Josh Maine July 27, 2026 Covered by The Wall Street Journal and Financial...
research · calif.io
Apple Internals: Swift in the Kernel
# Apple Internals: Swift in the Kernel A new series reverse-engineering Apple's internals. Josh Maine June 18, 2026 apple Contents 1. A new directory in /System 2. New Mach-O platform IDs 3. The...
blog · projectzero.google
The core of Apple is PPL: Breaking the XNU kernel's kernel
While doing research for the one-byte exploit technique, I considered several ways it might be possible to bypass Apple's Page Protection Layer (PPL) using just a physical address mapping primitive, that is, before obtaining kernel read/write or defeating PAC. Given that PPL is even more privileged than the rest of the XNU kernel, the idea of compromising PPL "before" XNU was appealing. In the end, though, I wasn't able to think of a way to break PPL using the physical mapping primitive alone.
blog · projectzero.google
Deja-XNU
This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2.
vulnerability · projectzero.google
[CVE-2017-2370] Exception-oriented exploitation on iOS
A Project Zero write-up on discovering and exploiting CVE-2017-2370, a heap buffer overflow in an iOS mach trap, using deliberate crashes to build a working exploit.
blog · projectzero.google
task_t considered harmful
A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.
Back