[macos]

September 25, 2026

• File-notification systems leak behaviour across Linux, Android, Windows and macOS (ACM CCS, 15–19 November, The Hague). On Windows, watching C:\ reports the full path of every file touched anywhere on the system regardless of permissions and across users — Microsoft calls it an undocumented feature, and the response earned a Pwnie nomination for lamest vendor response 2026. On Linux, an inotify watch on a readable directory reports events for files the attacker cannot read, including /dev/input for inter-keystroke timing. On Android, FileObserver bypasses the FUSE per-app storage view, demonstrated against WhatsApp. The authors say they are unaware of in-the-wild exploitation. inoti.fyi, The Register · Vulnerability Research
• A CDC-ACM serial interface bypasses TCC on macOS. glyph.sh · Vulnerability Research
• MacSync now uses public iCloud calendars to deliver new payloads. Kaspersky's updated analysis of the macOS infostealer/backdoor covers malicious DMG delivery, layered encrypted loaders, the shift from AppleScript to full executable modules, LaunchAgent persistence, Finder impersonation and encrypted C2. Securelist, BleepingComputer · Threat Activity

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls