| X | https://x.com/mysk_co |
| Blog | https://mysk.blog |
| YouTube | https://youtube.com/@mysk |
| Old Mastodon | https://defcon.social/@mysk |
If you like to support our unpaid charity work to keep the software of a 4-trillion-dollar company safe, take a moment to download and try our private browser for iOS Psylo:
https://apps.apple.com/app/psylo-private-browser-proxy/id6741358035
And coffee energizes our work:
We had lengthy discussions explaining the bug to Apple. It was clear to us the bug was new to Apple Product Security. After 5 months, they informed us that the report was treated as a duplicate and it was addressed.
We just got this update for CVE-2026-28910: No bounty
You can read the full blog post (aka charity work for a 4-trillion-dollar company) highlighting this bug here:
This exchange from X adds some context:
On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified.
This is a demo we prepared recently to show a macOS bug that allowed unrestricted access to protected app containers. WhatsApp stores data at rest without encryption.
