Mickey Jin

Exploring the world with my sword of debugger : )

[Mickey Jin @patch1t]

Love the gifts from @Apple Product Security! ❤️❤️❤️

[Mickey Jin @patch1t]

@theevilbit I did the same thing several months ago.🫣

[Mickey Jin @patch1t]

@Peterpan980927 In the AI era, the list will be updated frequently. I’m gradually stepping back to devote myself fully to my new baby.

[Mickey Jin @patch1t]

Cool 👍

[Csaba Fitzl @theevilbit]

🍎🐛 I got Claude making this, maybe it's useful for others as well.

Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.

https://t.co/aSv0PZpQj3

[Joseph Ravichandran @0xjprx]

I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)

- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉

Try it here: https://t.co/PEydRXL25G

[Mickey Jin @patch1t]

Empty vessels make the most noise.
Barking dogs seldom bite.

[Zhongquan Li @Guluisacat]

CVE-2026-28910 just saw the CVE information has been updated. Im the first one who found this vulnerability, on 5/8/25, five months before you did. And the impact was underestimated, it could do more things than your PoC.Easily weaponized. Keep calm. Your post made it sound like I had stolen your research. If you wanna verify the timing of other reports, DM them instead of doing something like this. Not geeky.

[Mickey Jin @patch1t]

@Guluisacat That makes sense now.

[Mickey Jin @patch1t]

@mysk_co This one is similar to my CVE-2026-20633, patched in macOS 26.4 too. However, my bug doesn’t require any user interaction. I can’t disclose the details right now because I have already submitted a bypass report 🫣

[Mickey Jin @patch1t]

@_rdowd Nice research, congrats!

[fG! @osxreverser]

The screensharingd bug is a pre-auth, and an amazing bug that LLM enabled clowns killed without understanding it. Releasing a PoC that allows to download files from vulnerable macOS. It’s not super reliable, but the real one is very much. Patch asap!

https://t.co/LV3teOyTTU

[Mickey Jin @patch1t]

@Coiffeur0x90 @0xjohnny After reading @lateralusd_ blog:
https://t.co/0Um9gN0BYu
I found the same bug that you found here, and then I reported to the ZDI.
Finally, it was disclosed as 0-day:
https://t.co/FI8EVlOIfo

[Csaba Fitzl @theevilbit]

🍎🌁 Big changes to user TCC.db in macOS Golden Gate! It seems that it finally got the protection it deserves.

It was moved to:
/private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/

You can't access it even with FDA, and likely need "com\.apple.private.security.protected-system-container" entitlement to write to it.

[[email protected] @CodeColorist]

Some observations from disassembly that might be related to iOS 27 performance boost

https://t.co/MvHDXiSe8o

[Csaba Fitzl @theevilbit]

IMO Mysk is not trustworthy. They tried to hype low impact vulns as critical in the past (HTTP icon download). Also... duplicates happen, and Apple always credits you for those. If you can't trust the vendor's decision about first submitter, then don't submit. I did cross check a few of these duplicates with researchers in the past, and Apple was always right.

[Mickey Jin @patch1t]

@theevilbit @gergely_kalman @theJoshMeister Yes, agreed. I don’t think mysk’s report is a real vulnerability.

[Mickey Jin @patch1t]

@mysk_co The CVE-2026-28910 requires the access to a protected plist file first, this shouldn’t be considered as a real vulnerability, in my humble opinion.

[Mickey Jin @patch1t]

@mysk_co Maybe the trick of social engineering is the vulnerability here. But you can get access to any protected file (not only the plist file) by convincing the victim to drag&drop.

[Mickey Jin @patch1t]

@mysk_co The CVE-2026-28910 requires the access to a protected plist file first, this shouldn’t be considered as a real vulnerability, in my humble opinion.

[Mickey Jin @patch1t]

@mysk_co This one is similar to my CVE-2026-20633, patched in macOS 26.4 too. However, my bug doesn’t require any user interaction. I can’t disclose the details right now because I have already submitted a bypass report 🫣

[Mickey Jin @patch1t]

@speedyfriend433 Congrats!

[Mickey Jin @patch1t]

@tonygo_ Congrats!

[Mickey Jin @patch1t]

@gefrorenerapfel @Apple Independent researcher

[Mickey Jin @patch1t]

Love the gifts from @Apple Product Security! ❤️❤️❤️