CISA has added Apple's CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The flaw is a pointer authentication bypass, and the attacks reportedly use it to deliver information-stealing malware. The important detail is that Apple already fixed this bug in 2024. If your devices are current, the practical risk is low. If they aren't, installing the Apple CVE-2024-27834 info-stealer update is the single most useful thing you can do today.
What CISA says about CVE-2024-27834
CISA's KEV catalog is a list of vulnerabilities that are known to be exploited in real attacks. Entries signal that a flaw has moved from theoretical risk to active threat, which is why the agency uses the list to push organizations to patch quickly. Adding CVE-2024-27834 follows reports of attacks that deliver info-stealing malware.
The bug is a pointer authentication bypass. Pointer authentication is a protection that makes it harder for attackers to tamper with how code runs in memory, so a bypass weakens one layer of defense. According to the National Vulnerability Database, Apple addressed the issue with improved checks. Apple's Safari 17.5 security notes list the bug as a WebKit issue and credit Manfred Paul, working with Trend Micro's Zero Day Initiative. The NVD entry dates to May 14, 2024, and lists fixes in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, and iOS 17.5 and iPadOS 17.5, among other releases.
In short, this is not a brand-new hole. It is an older, patched one that attackers are still finding useful.
What info-stealers take and why patched flaws still get exploited
Info-stealers are malware built to quietly collect data from an infected device and send it to the attacker. Depending on the variant, targets commonly include saved passwords, browser data, and session information. The source article does not detail exactly what this campaign takes, so treat that as a general description of the malware category rather than a finding about this specific attack.
Why would attackers bother with a flaw that was fixed long ago? Because patching is uneven. Older phones, tablets, and Macs sit unupdated for months or years, whether because people postpone prompts, devices are shared, or hardware is no longer running the latest software. Attackers know a fix being available is not the same as a fix being installed. A known, reliable exploit against unpatched devices is cheaper than developing a new one.
This pattern is familiar across the industry. Trusted software and trusted update habits are the real battleground, as we saw when a zero-day turned a Korean bank security tool into a weapon. Software people rely on for safety can become the way in when it isn't kept in check.
How to protect your iPhone and iPad now: the Apple CVE-2024-27834 info-stealer update
The fix is straightforward, and it takes a few minutes.
- Open Settings, then General, then Software Update. Install whatever is offered. Moving to the newest release available for your device is better than stopping at the minimum version that fixed this bug, since later updates carry other security fixes.
- Turn on automatic updates. In the same menu, enable automatic installation so future patches arrive without you having to remember.
- Update Safari and your Mac too. The NVD entry lists Safari and macOS among the affected products, so check System Settings on any Mac you use.
- Check older devices. If an iPhone or iPad can no longer receive the latest major version, see whether it has a security update for its own version. Apple released iOS 16.7.8 and iPadOS 16.7.8 for older hardware. If a device receives no more updates, consider retiring it from sensitive tasks like banking.
Where a VPN helps and where it doesn't
A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit. That is useful on public Wi-Fi and for general privacy. It is not a patch.
This flaw lives in how Apple's software handles code on your device. A VPN does not repair that, and it does not stop malware that is already running from reading data stored locally. If an info-stealer lands on an unpatched device, the tunnel your traffic travels through won't prevent it from collecting what is on the device. Some VPN apps include optional link or malware blocking, but those features vary and should not replace updating.
Think of a VPN as one layer of privacy, and a software update as the layer that actually closes this specific door.
What This Means For You
If your Apple devices are fully updated, you are protected against this particular flaw, and CISA's listing is mostly a reminder. If you've been ignoring update prompts, this is a good reason to stop. The more important lesson is about stolen credentials. Info-stealers are dangerous because the data they take can be reused on other accounts, so strong account hygiene limits the damage even if something slips through.
Key takeaways
- Update today. Install the latest iOS, iPadOS, macOS, and Safari updates and enable automatic updates. This is the core Apple CVE-2024-27834 info-stealer update step.
- Use unique passwords for every account, ideally through a password manager, so one stolen login doesn't unlock others.
- Turn on two-factor authentication wherever it is offered, especially for email, banking, and your Apple account.
- Don't rely on a VPN to fix a software flaw. Keep it for what it does well, like protecting traffic on untrusted networks.
- Stay skeptical of trusted tools. Our look at the AnySign4PC zero-day is another example of familiar software becoming an attack vector.
Check your Apple devices now, install pending updates, and spend ten minutes reviewing your account security. It is the most effective response to CISA's warning.
