U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog

CISA added Apple vulnerability CVE-2024-27834 (a Pointer Authentication bypass) to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by November 18, 2026; Apple released fixes across Safari, iOS/iPadOS, macOS, tvOS and watchOS. Security firm Sekoia reports active exploitation attributed with moderate-to-high confidence to Russia-linked APT29, which used compromised/fake sites and a Plerdy supply-chain compromise to deliver malicious JavaScript and a zero-click exploit chain that bypassed protections and deployed information-stealing malware.