In a blog post shared by ZDNet, security researcher Vishal Bharad claims that he found a bug that would have allowed a hacker to inject a virus or malicious script onto Apple's iCloud website.
According to Bharad, the vulnerability consisted of creating a Pages or Keynote document on the iCloud website with the name field containing the XSS payload. Sharing the document with another user, creating a change, saving, and then clicking "Browse All Versions" under Settings would have triggered the XSS payload.
Given the vulnerability revolved around the iCloud website, it's not linked to a recent software update and has reportedly been patched by Apple server-side. Bharad says he submitted the issue to Apple on August 7, 2020, and received a $5,000 bounty on October 9, 2020. We've reached out to Apple for comment and we'll update if we hear back.
Apple today said it is reversing its decision and will not change the email domain used for the iCloud+ Hide My Email feature.
Emails sent using Hide My Email will continue to use the same icloud.com domain that Apple uses for standard iCloud emails.
In June, Apple said it would unify the email domains used by Sign in with Apple and Hide My Email under a single private.icloud.com domain....
Tuesday August 11, 2026 8:24 am PDT by Joe Rossignol
If you are subscribed to an iCloud+ plan with at least 2TB of storage, you will receive new perks in the Home app on iOS 27, according to Apple.
Starting with iOS 27, Apple said iPhone users who are subscribed to an iCloud+ plan with at least 2TB of storage receive access to three new Apple Intelligence features in the Home app: generated video descriptions for HomeKit Secure Video cameras,...
Apple is facing a proposed class action lawsuit accusing it of fraud and false advertising over a security flaw in iCloud Private Relay, according to 9to5Mac.
The suit was filed by the Clarkson Law Firm, which accuses Apple of deceiving iCloud+ subscribers with its marketing of Private Relay, the feature meant to shield a user's IP address and DNS records while browsing in Safari. The firm ...
