#Security

Apple Maps appears to have started blurring its satellite imagery of a number of sensitive U.S. government sites, according to a report from Space Explored. Apple has not announced the change or explained it.

Seth Kurkowski of Space Explored says he identified the blurred locations by checking them himself. Among the NASA sites, the airfield at Wallops Flight Facility in Virginia is blurred, although its launch pads are not, and Stennis Space Center in Mississippi is also affected. Two Space Force locations, Cape Canaveral Space Force Station in Florida and Vandenberg Space Force Base in California, are blurred as well.

Apple's iOS 27.2 update closes a flaw that could have let a malicious app reach an iPhone's camera without the usual permission prompt, according to a security write-up from 9to5Mac.

The bug is tracked as CVE-2026-86990 and sits in CoreMedia, the system framework apps use to handle audio and video. Apple's own description is brief: it says an access issue was addressed with improved access restrictions. Security researcher Mustafa Calap is credited with the discovery. Apple has not said the flaw was exploited in the wild, and 9to5Mac's author notes that the problem is in software rather than hardware, and that the green camera indicator still lights up when the camera is in use, because the bug skips the permission check rather than the indicator.

A leftover update checker from an unofficial Popcorn Time app has been running on hundreds of thousands of Macs, and security researchers say it could have been hijacked to install malware. MacRumors reported the findings on October 29, based on research from the security firm Eye Research.

The software is Time4Popcorn, an unofficial fork distributed under the Popcorn Time name. According to Eye Research, its updater runs in the background on macOS as a launch daemon, so it starts with the Mac even if the user has not opened the app in years. It checks for updates over unencrypted HTTP and can download and run programs with root privileges on the Mac, the researchers say.

Apple has pushed security updates to older iPhones and iPads that close a flaw in CoreGraphics, the framework behind much of the system's graphics handling. According to Apple, the company is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, on versions of iOS before iOS 27. MacRumors reported the details on Tuesday.

The CoreGraphics fix arrives in iOS 18.7.11 and iPadOS 18.7.11. Those releases are aimed at hardware that cannot run iOS 26: the iPhone XS, iPhone XS Max, iPhone XR and the seventh-generation iPad. Apple describes the risk as follows: processing a maliciously crafted file could lead to arbitrary code execution.

Apple's iOS 27.2 and iPadOS 27.2 updates, released on Monday, carry fixes for more than 160 security vulnerabilities, according to a MacRumors summary of Apple's security notes.

The report says the patches span many parts of the system. One flaw in Apple Intelligence could have let a remote attacker reach sensitive data, and a bug in Hide My Email could have exposed a user's real email address. WebKit, the engine behind Safari, received more than 30 fixes, and the kernel received roughly 15.

Six of the listed CVEs credit Calif, the security firm that jailbroke the iPhone Duo on launch day and demonstrated an untethered jailbreak of iOS 27.0.1.

Apple has blocked a set of compromised web certificates issued by the Indian certificate authority eMudhra, according to an Apple support document. The company says the block has been in force since October 19, 2026.

The problem came to light earlier this month, when a security researcher found that the private cryptographic keys behind eight intermediate certificates from eMudhra were weak. Ars Technica first reported the discovery. In principle, weak keys could let an attacker produce certificates that browsers would accept for websites the attacker does not control. MacRumors notes there is currently no evidence that the keys were exploited maliciously.

Security researchers say they have jailbroken the iPhone Duo within hours of its release, according to a report from MacRumors citing the German outlet Heise.

The group, a security firm called Calif, showed an iPhone Duo running iOS 27.1 with its home screen icons and widgets moved around and an anime character added to the display. Stefan Esser, a researcher speaking to Heise, said the team had achieved the result on launch day. The MacRumors report does not say which chip the device uses or detail the exploit chain used on the Duo.

Apple has added blocks for a set of compromised web security certificates that could have helped attackers impersonate websites, according to reports from MacRumors, 9to5Mac and BleepingComputer.

The certificates were issued by the certificate authority eMudhra, according to MacRumors. Mozilla's investigation, tracked in Mozilla's Bugzilla as bug 2083449, found a flaw in how the private keys were generated: the keys were all numbers below 256, which means they could be recovered almost instantly. With a key in hand, an attacker could create fraudulent certificates that vulnerable software would trust, allowing a site to be spoofed.

Face ID debuted with the iPhone X in 2017 and replaced Touch ID on most iPhones. It relies on a set of sensors collectively called the TrueDepth camera system, housed in the notch or Dynamic Island area.

When you glance at your phone, a flood illuminator sends out infrared light so the system can detect a face even in darkness. A dot projector then casts a pattern of more than 30,000 invisible infrared dots onto the face, and an infrared camera captures how that pattern is distorted. The distortion encodes the three-dimensional shape of your features.