Thursday, November 5, 2026

Apple flaw used in watering-hole attacks to steal iPhone cookies, Sekoia says

Sekoia found the campaign in mid-October and links it to APT29 with moderate to high confidence, and Apple fixed the flaw in iOS 16.7.8 and 17.5 in May 2024.

• CVE-2024-27834

WatchGuard AuthPoint Gateway flaw lets unauthenticated attackers disrupt logins

Gateways set up with an Active Directory or LDAP provider are affected, WatchGuard knows of no attacks, and version 7.6.0 fixes it and three other flaws.

Elastic on hunting through AI coding agent sessions with embedding search

Across 7,454 turns of the author’s own Claude Code and Cursor sessions, one session in seven needed review, and the agent’s reasoning carried more signal than the prompt.