CISA KEV addition November 4, 2026; federal remediation due November 18, 2026; Apple fix released May 13, 2024; Sekoia Poisoned Source research published November 4, 2026
Patched 18 Months Ago, Exploited Now: CISA Lists the Apple WebKit Flaw Behind the Poisoned Source Watering Holes
CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog on November 4, with federal remediation due November 18 under BOD 26-04. The flaw is a WebKit improper authentication issue, classed CWE-287 and scored 5.5, that lets an attacker who already holds arbitrary read and write capability bypass Pointer Authentication, the hardware-backed check meant to keep memory corruption from becoming code execution. Apple shipped the fix on May 13, 2024, in iOS 17.5 and companion releases, after the bug was demonstrated at Pwn2Own Vancouver in March 2024 by Manfred Paul, working with the Zero Day Initiative. The KEV listing follows Sekoia research, published November 4, on a watering hole campaign it calls Poisoned Source, discovered in mid-October and attributed to APT29, the group tied to the Russian SVR foreign intelligence service, at moderate to high confidence. The campaign reached phones three ways: malicious JavaScript injected into legitimate websites, lookalike sites including one copying the America250 anniversary site, and a compromise of the Plerdy analytics tracker between August 27 and September 3 that carried the code to thousands of sites loading it. Sekoia recovered three exploit chains, all built from already patched flaws and none persistent: one against iOS 16.7 that steals browser cookies by chaining a WebKit remote code flaw with the Pointer Authentication bypass, a five-flaw DarkSword chain against iOS 18.5 that takes broad device data including messages, mail, WhatsApp and Telegram data, Keychain items, photos and Health data, and an Android chain against Chrome 139 through 145 that steals Chrome data and Wi-Fi passwords. Sekoia is explicit that no chain contains a zero-day and none works against a fully updated device, and that it remains unclear whether the operators targeted specific visitors or collected broadly and sorted later.
Executives
This campaign needed no new vulnerability at all. Every flaw it used had a vendor fix before the campaign began, one of them for eighteen months, so the entire operation ran on devices whose owners had simply not updated. That reframes mobile risk as a fleet currency problem rather than an exotic threat problem: the board-level question is what share of phones with access to mail, messaging, and single sign-on are running current operating systems, and what happens to access for the ones that are not.
CIO / CISO
Close CVE-2024-27834 on the KEV clock even though the score is 5.5: the listing reflects confirmed use inside a working chain, where a mitigation bypass is the difference between a crashed browser and stolen session cookies. Enforce a minimum operating system version for managed and BYOD access to corporate mail and identity, and treat long-unpatched devices as out of compliance rather than merely out of date. The Plerdy leg is a third-party script lesson as well: inventory the analytics and tag scripts your own public sites load, because your visitors inherit those vendors security.
Engineers
Verify device fleets by reported OS build, not by policy statement, and flag anything still on the targeted releases: iOS 16.7 and 18.5 era builds and Android Chrome 139 through 145. The chains do not persist, so a reboot clears the in-memory implant, but it does not return stolen cookies, Keychain items, or Wi-Fi passwords; where compromise is plausible, rotate credentials and revoke sessions rather than relying on the reboot. For web properties, review third-party script integrity and loading, and consider subresource integrity or an allowlist for analytics tags.
Everyone (non-IT)
Update your phone, turn on automatic updates, and restart it now and then. That is the whole defense against this campaign: every attack chain in it fails on a fully updated device, and none of them survives a reboot. If your phone is too old to take current updates, it is worth understanding that this is the specific risk that creates, because attackers build campaigns exactly around the phones that can no longer be patched.