APPLE FIXES ZERO-DAY FLAW USED IN 'EXTREMELY SOPHISTICATED' ATTACKS

Summary from the TLDR InfoSec newsletter

Apple patched CVE-2026-20700, an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor) discovered by Google's Threat Analysis Group, which was exploited in targeted attacks against specific individuals running iOS versions before iOS 26, marking the first Apple zero-day patched in 2026. The flaw, chained with two previously patched vulnerabilities (CVE-2025-14174 and CVE-2025-43529), affects iPhone 11 and later, iPad, Mac, Apple TV, Apple Watch, and Vision Pro devices. Fixes are available in iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.