We don’t fix things for applause or bounties. We fix them so our customers are safe.
Quietly. Thoroughly. Across every product.
If that disappoints someone who wanted a stage and a check, so be it.
Apple’s job is not to make researchers feel good.
It’s to make the best produc
Planned to drop a macOS 0day at OffensiveCon 2026 in Berlin 5 months ago. Submitted it to Apple 3 years ago, and Apple confirmed the vulnerability but closed the report. it's a universal method to bypass many security protections on macOS and you can fully bypass TCC and gain other privileged access as you want, easilly weaponized.
Although I mentioned the impact multiple times, there were no updates for the next 2 years until my presentation was accepted by OffensiveCon26 Berlin. Apple asked me to hold off on disclosure and not disclose the vulnerability at OffensiveCon26 Berlin, saying a patch would be released in macOS 27 in Fall 2026. They also mentioned "bounty" multiple times.
Honestly, I did have some complaints because their workflow was really bad. No updates at all until disclosure was about to happen. But as long as they decided to patch it, I was willing to wait, even without a bug bounty, for user safety. If Apple wasn't going to release a patch for 3 years, I'd disclose the vulnerability so EDR vendors could protect users too.
But in September, when the vulnerability was patched, there was no cve, no credit, and no bounty.
I really don't get why apple chose to handle it in such a dishonest and underhanded way, a cheat. Even if they had never mentioned a bounty, I still would have held off on disclosure because they were going to publish a security bulletin.
this is a huge disappointment in my experience with the Apple Security Bounty program. never thought I'd encounter something like this. As i said on my blog a few years ago, my experience with ASB had been positive. that's why I was willing to wait for the patch even without a bounty, but not to be cheated like this
An IShowSpeed fan has won $250,000 by tracking down his location after he challenged viewers to find him live on stream
Ben is a nursing student who only had $2,000 in his bank account