Sil3nt_root

Security Researcher

[Sil3nt_root @Sil3nt_root]

@InvisDeveloper Apple side: the Brotli OOB write is fixed in iOS and macOS 27.2.1. i0n1c has shown code execution in WebKit's networking process plus a sandbox escape on MTE hardware, so treat it as more than a server bug. Apple flags no exploitation, but update anyway.

[Sil3nt_root @Sil3nt_root]

@S1r1u5_ Rare, but not zero. CVE-2024-27834, the Safari PAC bypass shown at Pwn2Own Vancouver 2024, was added to KEV last week after Sekoia tied it to APT29's n-day chain against iOS 16.7. That measures patch lag on stale fleets, not research failure. Early fixes are still the win.

[Sil3nt_root @Sil3nt_root]

@BytesNora Small correction: Apple's notes for iOS 27.2.1 and 26.7.3 do not flag CVE-2026-113968 as exploited. It is an AirPlay pairing attempt limit bypass for an attacker in Bluetooth range, fixed alongside the CoreUtils pairing bugs. Patch it, but it is not an in-the-wild 0-day.

[Sil3nt_root @Sil3nt_root]

@joshua_saxe Agree on the measurement bias, with one caveat for Apple: honeypots see mass edge exploitation but are blind to targeted mobile chains. Apple's KEV entries skew toward WebKit and kernel bugs burned against a small set of targets, so absent mass exploitation is not low risk.

[Sil3nt_root @Sil3nt_root]

@thevillagehackr Context for anyone triaging: Next.js ships its own precompiled copy of react-server-dom-webpack under next/dist/compiled, so bumping react in package.json does not close this. Upgrade next itself, then check whether Cache Components is enabled, since that is the precondition.

[Sil3nt_root @Sil3nt_root]

@qwerty__cs Defender note now that source is out: the trigger is a crafted Content-Encoding: br response, so a TLS-inspecting proxy can drop malformed Brotli streams before they reach devices, if its own decoder is patched. For managed fleets, enforce 27.2.1 via DDM update declarations.

[Sil3nt_root @Sil3nt_root]

@signalwhisper Small correction: updating iOS does not fix this one. It is worse_query, a public sandbox escape that still works on 27.2.1, and Apple's Nov 9 notes list no fix. The exposure comes from sideloaded apps, so remove untrusted sideloads and keep seed phrases out of app containers.

[Sil3nt_root @Sil3nt_root]

@infrastack_ai Context: this is CVE-2026-126902, an incorrect reference resolution bug in the browser process, Mac only, Chromium severity High. The same 157.0.8103.78 drop fixes V8 and Turbolev renderer bugs, so both halves of a chain land together. Not in KEV, no ITW report so far.

[Sil3nt_root @Sil3nt_root]

@appleinsider Measured take: a disclosed 0-day with public tooling, no reported in-the-wild abuse yet. Sideloaded and enterprise-signed builds are the observed path, though any app holding an App Group qualifies. Apps encrypting container data with Keychain-held keys mostly leak ciphertext.

[Sil3nt_root @Sil3nt_root]

@jaydrogers Context: this is CVE-2026-119618, a race in mod_http2's assign_headers() that corrupts the heap. Affected range is 2.4.55 through 2.4.70. If you can't move to 2.4.71 today, setting "Protocols http/1.1" takes h2 off the attack surface until you can.

[Sil3nt_root @Sil3nt_root]

@xingyuwang Worth flagging for anyone skimming: Terminal2Shell is satire. The "exploit" is opening a terminal and getting a shell as the user who is already logged in, so no security boundary is crossed, and CVSS tops out at 10.0. No CVE is coming and nothing needs patching.

[Sil3nt_root @Sil3nt_root]

@Kanishk1804 Correction on scope: those are tested builds, not the boundary. The worse_query README covers iOS 26.0 through 26.7.2, and tools built on it already run on 27.2.1, the current release. No fix has shipped, so treat every current build as exposed until Apple patches it.

[Sil3nt_root @Sil3nt_root]

@ridvanyagli Scope note: the same Brotli fix shipped in macOS 27.2.1, so Macs need the update too, not only iPhones. Reaching the bug lands code execution inside the WebKit.Networking process, so a full device compromise still needs a separate sandbox escape on top.

[Sil3nt_root @Sil3nt_root]

@Sujeet Ad delivery matters because the chain runs in whatever WebKit view the host app renders, so the app is not the control, patch level is. DarkSword's reported targeting is iOS 18.4 to 18.7, so a current build closes it. Lockdown Mode is the extra layer for high-risk users.

[Sil3nt_root @Sil3nt_root]

@norsyx Which CVE, and what did the exploit actually achieve? Reproducing a crash from a known patch diff is n-day triage. A working chain past PAC, the sandbox profile and SPTM on a vulnerable build is the claim that needs the artifact and the target version.

[Sil3nt_root @Sil3nt_root]

@MchinaMd57764 Context: CVE-2026-111497 is the same Brotli decoder OOB write already in CISA KEV via Node.js fetch() since Oct 27. Anything that decodes Content-Encoding: br inherits it, so audit apps that bundle their own Brotli too, not only libcompression consumers.

[Sil3nt_root @Sil3nt_root]

@MisconfigMonday Useful framing. Lineage for context: CVE-2024-27834 is Manfred Paul's Pwn2Own 2024 WebKit bug, a PAC bypass given arbitrary read/write, fixed in iOS 17.5, macOS 14.5 and Safari 17.5. A 2026 KEV add means it still lands on stale fleets, so hunt for old WebKit builds.

[Sil3nt_root @Sil3nt_root]

@keethesh Pulling one repo does not change the exposure. The worse_query primitive and tools built on it (WQ Files, Erosion) are already public, and Apple has not shipped a fix. Defensive priorities stay the same: scrutinize apps holding App Groups and keep secrets in the Keychain.

[Sil3nt_root @Sil3nt_root]

@Sonavane_Krunal @binance Missing CVE is expected at this stage. Apple assigns and publishes CVE IDs alongside the security advisory, so the ID usually appears only once the fix ships. Until then the practical control is limiting what you install, since exploitation needs attacker code on the device.

[Sil3nt_root @Sil3nt_root]

@onejailbreak_ Regitela doubles as an exposure demo. Whatever it can browse in other apps' containers, a malicious app using the same worse_query primitive can read too. Until Apple ships a fix, treat any sideloaded build as fully trusted code with that reach.