In a blog post shared by ZDNet, security researcher Vishal Bharad claims that he found a bug that would have allowed a hacker to inject a virus or malicious script onto Apple's iCloud website.
According to Bharad, the vulnerability consisted of creating a Pages or Keynote document on the iCloud website with the name field containing the XSS payload. Sharing the document with another user, creating a change, saving, and then clicking "Browse All Versions" under Settings would have triggered the XSS payload.
Given the vulnerability revolved around the iCloud website, it's not linked to a recent software update and has reportedly been patched by Apple server-side. Bharad says he submitted the issue to Apple on August 7, 2020, and received a $5,000 bounty on October 9, 2020. We've reached out to Apple for comment and we'll update if we hear back.
Wednesday November 4, 2026 11:12 am PST by Juli Clover
Apple says it will start checking public iCloud links for harmful content in iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3.
Images in iCloud Photos and files in iCloud Drive shared using the "Anyone with the link" option will be "made accessible to Apple" for a content check. Apple doesn't define harmful content, but it could mean malware, malicious files, and/or child sexual abuse...
Monday November 9, 2026 9:45 am PST by Joe Rossignol
Apple continues to advise customers that certain Apple Intelligence features that rely on its server-side Private Cloud Compute system have daily usage limits, with expanded access to such features to be "available for a fee in the future."
Apple has repeatedly mentioned these upcoming fees in press releases over the past several months, but it has yet to provide any specific details about...
Sunday November 8, 2026 7:42 am PST by Joe Rossignol
Apple has made a change to its development process for iOS 28, macOS 28, and corresponding software updates, according to Bloomberg's Mark Gurman.
In his Power On newsletter today, he said Apple separates development of each year's new operating systems into three major stages. Typically, he said each stage consists of four weeks of coding followed by a four-week "convergence" period where...
