CISA Orders Agencies to Fix an Apple Flaw Patched in 2024 as Hackers Exploit It

CISA, the federal cyber agency, listed an Apple security flaw as under active attack and gave federal civilian agencies until Nov. 18 to patch it, according to a published report. Apple fixed the bug in May 2024.

A fix more than two years old protects nothing on a device that never installed it. The listing is CISA’s evidence that attackers are using this bug now, and CISA urges every organization to put listed flaws first in its patching. That puts a question to any company that runs iPhones, iPads or Macs and skipped the 2024 updates.

Who has to fix it, and who should?

The deadline applies only to federal civilian agencies, under a CISA directive that requires them to move fast on listed flaws that hand an attacker total control of an exposed system, and to check whether attackers got in before the patch. Other organizations face no such rule; CISA only encourages them to follow the same priorities.

The flaw, CVE-2024-27834, sits in the engine behind Safari. Apple described it as a way for an attacker who can already read and write a device’s memory to defeat Pointer Authentication, a protection against hijacked code.

What did Apple fix, and when?

Apple shipped the fix on May 13, 2024, in macOS Sonoma 14.5. The report said the same round of updates covered iPhones and iPads (iOS and iPadOS 17.5), Apple Watches and Safari. Any device on software older than those releases is still open to the bug.

Is this the Russian campaign?

Sekoia, a security firm, describes a campaign it assesses with moderate to high confidence as the work of APT29, the Russian foreign-intelligence-linked group also known as Midnight Blizzard and Cozy Bear. The attackers used hacked sites and lookalike domains to push code that exploited flaws Apple and Google had already fixed.

They also compromised Plerdy, a Ukrainian website analytics service, between Aug. 27 and Sept. 3. Its script runs on thousands of sites, and hundreds of them served the attackers’ code. Every flaw in the campaign was fixed before it began, so a device with current software is safe from it; Sekoia did not say how many devices were hit.

CISA did not say whether its listing stems from that campaign. Either way, the exposure sits in the same place: devices that never took the update.

How many of the company’s Apple devices still run software from before May 2024?