Apple's CVE-2024-27834, Patched in May 2024, Reaches CISA's KEV on Sekoia's Report of an APT29-Linked Web Campaign
Security / news
Apple's CVE-2024-27834, Patched in May 2024, Reaches CISA's KEV on Sekoia's Report of an APT29-Linked Web Campaign
A 5.5-rated pointer authentication bypass is the second stage of an iOS 16.7 cookie-stealing chain. Sekoia's report also names a Plerdy SEO Tracker compromise and an Android chain.
CISA added CVE-2024-27834, an Apple pointer authentication bypass that Apple fixed in May 2024, to its Known Exploited Vulnerabilities catalog on November 4, 2026. Federal civilian agencies have until November 18 to patch, according to The Hacker News.
The attacker needs arbitrary read and write access inside the target process before the flaw is useful, which means it is a second-stage tool, never a way in by itself. The practical consequence is narrow: devices on iOS 16.7 builds below 16.7.8, or any Apple platform that skipped the May 2024 updates.
What CISA said and what it did not
CISA's alert lists the entry as "Apple Multiple Products Improper Authentication Vulnerability" and cites evidence of active exploitation. The alert text does not name an actor and does not state a remediation date; the November 18 date comes from the KEV catalog, which lists a due date of 2026-11-18 for the entry.
The link to a campaign comes from The Hacker News, which cites a technical report by Sekoia. The Hacker News names the Sekoia researchers as Amaury-Jacques Garçon and Félix Aime and says the activity was found in mid-October 2026. I could not retrieve Sekoia's own report, so every campaign detail below is as The Hacker News relays it.
The campaign Sekoia calls Poisoned Source
The Hacker News says Russia-linked APT29 is "presumed" responsible. A JavaScript loader profiles the visitor's browser and device, then serves an exploit chain for iOS or Android. Sekoia says it is unclear whether the aim was specific visitors or unpatched phones in bulk.
Three routes delivered the loader.
- Compromised legitimate websites carrying injected JavaScript.
- Lookalike domains, including america250[.]holiday and sites aimed at Ukraine, the Czech Republic and Bulgaria.
- A supply-chain compromise of Plerdy SEO Tracker, a Ukrainian analytics service, where code was injected into a.plerdy[.]com/public/js/click/main.js between August 27 and September 3, 2026.
The Hacker News lists victim types without names: a U.S. chemical-industry trade association, a far-right European political party and a Bulgarian military-related site.
Three exploit classes, one of them this CVE
| Class | Target | CVEs listed | Goal |
|---|---|---|---|
| A | iOS 16.7 | CVE-2025-43529, CVE-2024-27834 | Cookie-stealing JavaScript |
| B | iOS 18.5 | DarkSword chain, five CVEs | Full device data exfiltration |
| C | Android, Chrome 139 to 145 | CVE-2026-3910, CVE-2025-27038 | AndroSnitch payload |
CVE-2024-27834 appears only in class A. Class B, the DarkSword chain, pulls messages, Keychain items and Wi-Fi passwords. The source says Chrome 143 was excluded from class C for a reason the report does not give. All three classes send data to ad.starx-net[.]com:8881/telemetry/v12.
The score understates what the entry means
A 5.5 reads as a nuisance, and on its own it is. The bypass only works once an attacker can already read and write memory, which in this chain the WebKit flaw CVE-2025-43529 supplies. The score understates the risk because the pair together yields code execution from a web page.
The Hacker News also lists CVE-2025-43529 in both roles in one paragraph, which looks like a typo. CISA's alert names only CVE-2024-27834 as the new entry, so this article treats that as the PAC bypass.
Attribution is thin. The Hacker News calls APT29 "presumed" in its campaign article and "moderate to high" confidence in its KEV article, and I could not check either against Sekoia's own text.
What to do
Apple's May 2024 fixes cover iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. Any device on a build below those is exposed to the class A chain. Check it, then update. The Hacker News gives no other guidance, and the campaign's indicators, including the exfiltration host above, are the first thing to search proxy logs for before November 18.
Two earlier KEV entries show how quickly the clock runs under the directive: see BOD 26-04 deadlines and the Brotli decoder flaw.
Sources
More in Security
- 01Plex2Shell Reached CISA's KEV 78 Days After Plex Shipped the FixFour Plex Media Server flaws chain into unauthenticated code execution on any server older than 1.43.3.10861, and attackers were installing miners within a day of a public proof of concept.
- 02CISA's BOD 26-04 Deadlines: 120 of 152 KEV Entries Since June Carry a Three-Day DeadlineThe directive that replaced BOD 22-01 on June 10 sets deadlines by exposure and exploit risk, and the catalog shows the short window is now the norm.
- 03VMware ESX Flaw Rated 2.7 Was a Zero-Day for Warp PandaCVE-2026-41709 lets an administrator skip the audit log, CrowdStrike says a China-nexus group used it in early 2026, and ESXi 7.0 has no listed fix.
- 04CERT-In's 107-Page AI Audit Rules Set Four Risk TiersThe Nov. 4 guidelines tie audit frequency and remediation deadlines to a system's tier, and RBI's separate API advisory carries its own Dec. 3 and Feb. 3 dates.