macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools

XM Cyber disclosed a macOS structural vulnerability that lets local unprivileged users chain CDHash cache exploitation with NIB payload injection against XPC services to impersonate trusted applications and issue privileged commands to background security agents, resulting in EDR/MDM unloading and telemetry removal; researchers demonstrated the technique against CrowdStrike Falcon, Kandji, and a third vendor, and vendors have issued patches and mitigations.