Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those... show more

CertiK

558,165 subscribers

341,505 views • 2 years ago •via X (Twitter)

Health & Wellness Science & Technology News & Politics

Anya Rossi• Live Now

Private livecam show

6 Comments

CertiK2 years ago

Acknowledgement🔒

FOUR | Crypto Spaces2 years ago

@CertiKSkyfall @Apple Nice catch! Glad they squashed that bug before any troublemakers got busy with it. Always good to have a team keeping an eye out for us.

Murtaza⚡2 years ago

@CertiKSkyfall @Apple Amazing Certik!

André Destro2 years ago

@CertiKSkyfall @Apple a

Sanders Olive2 years ago

@CertiKSkyfall @Apple 👍

lamor gigi2 years ago

@CertiKSkyfall @Apple good news

Related Videos

You use your Apple ID to set up a new device and sign in to all the services from Apple. Watch our video below to learn more about your Apple ID and how to keep it safe and secure.

You use your Apple ID to set up a new device and sign in to all the services from Apple. Watch our video below to learn more about your Apple ID and how to keep it safe and secure.

Apple Support

100,978 views • 3 years ago

I recently got access to OpenAI’s Trusted Access for Cyber program. With all the GPT-5.5 hype and the Anthropic Mythos discussion, I wanted to test it for myself. The result: **GPT-5.4** helped identify and develop a working Safari exploit affecting all Apple devices. It found a JSC WebAssembly use-after-free that gave us stale read/write access inside the Primitive Gigacage. Then it spotted a bug in Safari’s Fetch implementation where in-flight opaque cross-origin responses could be materialized inside renderer memory. By combining the two, a malicious page could steal authenticated cross-origin data and completely defeat the Same-Origin Policy.

I recently got access to OpenAI’s Trusted Access for Cyber program. With all the GPT-5.5 hype and the Anthropic Mythos discussion, I wanted to test it for myself. The result: GPT-5.4 helped identify and develop a working Safari exploit affecting all Apple devices. It found a JSC WebAssembly use-after-free that gave us stale read/write access inside the Primitive Gigacage. Then it spotted a bug in Safari’s Fetch implementation where in-flight opaque cross-origin responses could be materialized inside renderer memory. By combining the two, a malicious page could steal authenticated cross-origin data and completely defeat the Same-Origin Policy.

Ron Masas

72,667 views • 5 months ago

Chat GPT was hacked😵‍💫👀😱🚨🚨The vulnerability and danger it can cause to steal all your logs in and possible take over your devices remotely. Well today OpenAI confirmed the hack! This video will show you step by step instructions to help remove any of the malicious code if your account was compromised, and to help protect yourself and your data in the future. Please share this with your family and friends..

Chat GPT was hacked😵‍💫👀😱🚨🚨The vulnerability and danger it can cause to steal all your logs in and possible take over your devices remotely. Well today OpenAI confirmed the hack! This video will show you step by step instructions to help remove any of the malicious code if your account was compromised, and to help protect yourself and your data in the future. Please share this with your family and friends..

Inspirenaire

113,149 views • 9 months ago

TeaOnHer launched in response to women's safety app Tea, with similar features and a familiar lack of user protections that allowed anyone to access user data, just like the app it mirrors. Get the full recap on how both apps rose to popularity while exposing user information:

TeaOnHer launched in response to women's safety app Tea, with similar features and a familiar lack of user protections that allowed anyone to access user data, just like the app it mirrors. Get the full recap on how both apps rose to popularity while exposing user information:

TechCrunch

20,630 views • 1 year ago

CertiK was thrilled to be part of the 2024 Qualcomm's Product Security Summit today. We demonstrated critical vulnerabilities in Crypto POS systems, highlighting how security can be easily compromised. 🛡️ Check out our Vulnerability 1 & 2 videos to see our findings! 👇

CertiK was thrilled to be part of the 2024 Qualcomm's Product Security Summit today. We demonstrated critical vulnerabilities in Crypto POS systems, highlighting how security can be easily compromised. 🛡️ Check out our Vulnerability 1 & 2 videos to see our findings! 👇

CertiK

260,055 views • 2 years ago

JUST IN: Apple CEO Tim Cook to step down as CEO, will be replaced by John Ternus. Ternus, senior vice president of Hardware Engineering, will become Apple’s CEO effective on September 1, 2026, according to Apple. "It has been the greatest privilege of my life to be the CEO of Apple and to have been trusted to lead such an extraordinary company," Cook said. "I love Apple with all of my being, and I am so grateful to have had the opportunity to work with a team of such ingenious, innovative, creative, and deeply caring people who have been unwavering in their dedication to enriching the lives of our customers and creating the best products and services in the world." "John Ternus has the mind of an engineer, the soul of an innovator, and the heart to lead with integrity and with honor. He is a visionary whose contributions to Apple over 25 years are already too numerous to count, and he is without question the right person to lead Apple into the future." "I could not be more confident in his abilities and his character, and I look forward to working closely with him on this transition and in my new role as executive chairman."

JUST IN: Apple CEO Tim Cook to step down as CEO, will be replaced by John Ternus. Ternus, senior vice president of Hardware Engineering, will become Apple’s CEO effective on September 1, 2026, according to Apple. "It has been the greatest privilege of my life to be the CEO of Apple and to have been trusted to lead such an extraordinary company," Cook said. "I love Apple with all of my being, and I am so grateful to have had the opportunity to work with a team of such ingenious, innovative, creative, and deeply caring people who have been unwavering in their dedication to enriching the lives of our customers and creating the best products and services in the world." "John Ternus has the mind of an engineer, the soul of an innovator, and the heart to lead with integrity and with honor. He is a visionary whose contributions to Apple over 25 years are already too numerous to count, and he is without question the right person to lead Apple into the future." "I could not be more confident in his abilities and his character, and I look forward to working closely with him on this transition and in my new role as executive chairman."

Collin Rugg

1,765,332 views • 5 months ago

Multiple Americans are saying that someone has gained access to their iPhones While in the YouTube app, she suddenly hears on her phone typing, breathing, her ‘camera on’ indicator is lit up, she says the man was a foreign man speaking and typing Multiple other people have said recently similar things have happened while in YouTube I’ve looked into this and from what I can find it’s extremely rare, especially for the level of security Apple has For this to work for a hacker to take control of your phone or app - You would have had to have installed a malicious app or clicked a phishing link earlier. Something like a fake “YouTube update” or adult site redirect - Or physical access to your phone at some point to install spyware - Spyware or Remote Access Tool Once inside, the malware could request or silently use your camera and mic permission - It could run in the background and disguising itself as a legitimate process in your phone The “typing, clicking, breathing, man’s voice” she described could be the attacker live-monitoring or testing controls Even if you accidentally got this on your phone, the hacker would still likely be limited Likely saying in YouTube with background access only to your camera and mic while YouTube plays normally Even still, this is extremely creepy and not something you want to happen. This is exactly the type of thing you’d expect from an Indian scammer or something Down click bad links or ever grant permissions to things not trustworthy Luckily likelihood is very low on Apple iPhones with their security and sandboxing

Multiple Americans are saying that someone has gained access to their iPhones While in the YouTube app, she suddenly hears on her phone typing, breathing, her ‘camera on’ indicator is lit up, she says the man was a foreign man speaking and typing Multiple other people have said recently similar things have happened while in YouTube I’ve looked into this and from what I can find it’s extremely rare, especially for the level of security Apple has For this to work for a hacker to take control of your phone or app - You would have had to have installed a malicious app or clicked a phishing link earlier. Something like a fake “YouTube update” or adult site redirect - Or physical access to your phone at some point to install spyware - Spyware or Remote Access Tool Once inside, the malware could request or silently use your camera and mic permission - It could run in the background and disguising itself as a legitimate process in your phone The “typing, clicking, breathing, man’s voice” she described could be the attacker live-monitoring or testing controls Even if you accidentally got this on your phone, the hacker would still likely be limited Likely saying in YouTube with background access only to your camera and mic while YouTube plays normally Even still, this is extremely creepy and not something you want to happen. This is exactly the type of thing you’d expect from an Indian scammer or something Down click bad links or ever grant permissions to things not trustworthy Luckily likelihood is very low on Apple iPhones with their security and sandboxing

Wall Street Apes

313,831 views • 2 months ago

Apple is releasing an update to Siri that will allow their AI agent to read every part of your phone This includes your messages, email, notes, files, photos, calendar, app content and more This is fully mass surveillance and data gathering, it’ll even have access to your health data and location history Just think it US Government had a back door into this Siri AI system, this isn’t something that’s unlikely. They had a backdoor into old Twitter and they have worked very closely with Apple in the past Siri even came from US government, from DARPA

Apple is releasing an update to Siri that will allow their AI agent to read every part of your phone This includes your messages, email, notes, files, photos, calendar, app content and more This is fully mass surveillance and data gathering, it’ll even have access to your health data and location history Just think it US Government had a back door into this Siri AI system, this isn’t something that’s unlikely. They had a backdoor into old Twitter and they have worked very closely with Apple in the past Siri even came from US government, from DARPA

Wall Street Apes

349,790 views • 3 months ago

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

H4x0r.DZ 🇰🇵

61,607 views • 1 year ago

⚠️ YOUR BANK ACCOUNT CAN ALSO BE COMPROMISED WITHOUT AN OTP Apart from OTP-based scams these guys are using FRSC traffic violation messages to do, there’s another method criminals use to steal money from people’s bank accounts, and it’s becoming increasingly common. You click a malicious link, or a fake prompt, and you may unknowingly install malware on your phone. Once installed, the malware can abuse your device’s permissions and potentially monitor what you do, interact with apps, intercept sensitive information, and even gain access to your bank applications. Never click suspicious links or install apps from untrusted sources. One careless tap can give a scammer access to far more than you intended. Attached is an example of how they can take control of your phone in this video We can find and remove such app if already installed on your phone. Stay alert. Stay protected. 🔐 Follow AYO💡💡 for more digital security awareness.

⚠️ YOUR BANK ACCOUNT CAN ALSO BE COMPROMISED WITHOUT AN OTP Apart from OTP-based scams these guys are using FRSC traffic violation messages to do, there’s another method criminals use to steal money from people’s bank accounts, and it’s becoming increasingly common. You click a malicious link, or a fake prompt, and you may unknowingly install malware on your phone. Once installed, the malware can abuse your device’s permissions and potentially monitor what you do, interact with apps, intercept sensitive information, and even gain access to your bank applications. Never click suspicious links or install apps from untrusted sources. One careless tap can give a scammer access to far more than you intended. Attached is an example of how they can take control of your phone in this video We can find and remove such app if already installed on your phone. Stay alert. Stay protected. 🔐 Follow AYO💡💡 for more digital security awareness.

AYO💡💡

90,225 views • 15 days ago

“A Google engineer took all the IP of how Google designed their AI chips, moved to China, and then started a company. DeepSeek came out of nowhere. Everyone was so surprised at how capable their model was—or they managed to have a high-end espionage operation to steal all of our trade secrets from the United States and then re-implement them back in China… The way he stole the data out of Google's corporate cloud was so stupid. He just copy-pasted all the code into Apple Notes, exported it to PDF, printed it, and then just walked out with it. That’s it.” Alexandr Wang

“A Google engineer took all the IP of how Google designed their AI chips, moved to China, and then started a company. DeepSeek came out of nowhere. Everyone was so surprised at how capable their model was—or they managed to have a high-end espionage operation to steal all of our trade secrets from the United States and then re-implement them back in China… The way he stole the data out of Google's corporate cloud was so stupid. He just copy-pasted all the code into Apple Notes, exported it to PDF, printed it, and then just walked out with it. That’s it.” Alexandr Wang

Shawn Ryan

558,582 views • 1 year ago

Today #CertiK celebrates 5 years 🎂 Since 12/21/18 from a team size of 7 to today with a team size of nearly 300 📈 We've audited over 3700+ projects & protected $360B of assets 🔐 Join us on this journey 👇 and the many more to come as we continue to Secure the #Web3 World!

Today #CertiK celebrates 5 years 🎂 Since 12/21/18 from a team size of 7 to today with a team size of nearly 300 📈 We've audited over 3700+ projects & protected $360B of assets 🔐 Join us on this journey 👇 and the many more to come as we continue to Secure the #Web3 World!

CertiK

170,877 views • 3 years ago

Maricopa County Election Director admits in court that employees were logging in to the election system FROM HOME to REMOTELY verify ballot signatures in the 2020 election and others, with ZERO OBSERVERS, or any physical oversight whatsoever. This creates a major security vulnerability and lack of transparency/chain-of-custody in one of the most important steps of the ballot verification process. 21%-25% or 420,000+ ballots in Maricopa County alone failed signature verification. ANYONE could be accessing the data from someone's house or that worker could be hacked and gain access to the entire system. This is a HUGE breach of security and compromised the entire 2020 and 2022 elections.

Maricopa County Election Director admits in court that employees were logging in to the election system FROM HOME to REMOTELY verify ballot signatures in the 2020 election and others, with ZERO OBSERVERS, or any physical oversight whatsoever. This creates a major security vulnerability and lack of transparency/chain-of-custody in one of the most important steps of the ballot verification process. 21%-25% or 420,000+ ballots in Maricopa County alone failed signature verification. ANYONE could be accessing the data from someone's house or that worker could be hacked and gain access to the entire system. This is a HUGE breach of security and compromised the entire 2020 and 2022 elections.

The SCIF

245,179 views • 3 months ago

If one man can steal so much from a state, just imagine what he could do when he gains access to the federal level. Perhaps he will attempt to own all of Nigeria, potentially even selling Aso Rock to himself." #ObiDattilnLagos CBN Governor Tinubu and APC Lagos State Labour Party

If one man can steal so much from a state, just imagine what he could do when he gains access to the federal level. Perhaps he will attempt to own all of Nigeria, potentially even selling Aso Rock to himself." #ObiDattilnLagos CBN Governor Tinubu and APC Lagos State Labour Party

preach love ❤️

74,081 views • 3 years ago

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

Carlos Vieira

37,588 views • 4 months ago

BOOMI MY NEW GROK DEVICE! I HAVE Grok ON AN OLD APPLE WATCH MADE IN TO A RETRO IPOD! Still working on it but my goal to have a remote single purpose Grok device has been achieved! With the benefits of posting my grifter slop on to X from this device also (that is another article). And a minimal phone. So how did I do it? First I got this IPod converter kit: it is a beautiful device to hold made of Aluminum. Second I got this app: “Ask Watch AI” it has a free version. Third I got my XAI Grok API Key: Toss a few bucks in the account to fund it. Finally I set up the system by answering questions. This is my first run. I am coding an app for the Apple Watch that will be easier than pressing “done”. I will write a full article on it as soon as I get it done. My goal is to use the cell plan on this Apple Watch and to have a minimal phone and Grok device. Soon these devices will be sent to Starlink. With full Grok Bot and Grok Build. No need for an OS or an App. Obviously this is an Apple Watch but soon it will be a device like this of course with a camera too.

BOOMI MY NEW GROK DEVICE! I HAVE Grok ON AN OLD APPLE WATCH MADE IN TO A RETRO IPOD! Still working on it but my goal to have a remote single purpose Grok device has been achieved! With the benefits of posting my grifter slop on to X from this device also (that is another article). And a minimal phone. So how did I do it? First I got this IPod converter kit: it is a beautiful device to hold made of Aluminum. Second I got this app: “Ask Watch AI” it has a free version. Third I got my XAI Grok API Key: Toss a few bucks in the account to fund it. Finally I set up the system by answering questions. This is my first run. I am coding an app for the Apple Watch that will be easier than pressing “done”. I will write a full article on it as soon as I get it done. My goal is to use the cell plan on this Apple Watch and to have a minimal phone and Grok device. Soon these devices will be sent to Starlink. With full Grok Bot and Grok Build. No need for an OS or an App. Obviously this is an Apple Watch but soon it will be a device like this of course with a camera too.

Brian Roemmele

33,846 views • 1 month ago

What if Apple actually made an umbrella? 🍎☔ The iShield 18 Fold isn’t real but this concept makes it feel surprisingly believable. Exploring how a simple product idea can be turned into a complete AI commercial with FlovaAI — from concept and shots to structure and final video. All in one workflow. Fan-made concept. Not affiliated with Apple.

What if Apple actually made an umbrella? 🍎☔ The iShield 18 Fold isn’t real but this concept makes it feel surprisingly believable. Exploring how a simple product idea can be turned into a complete AI commercial with FlovaAI — from concept and shots to structure and final video. All in one workflow. Fan-made concept. Not affiliated with Apple.

Aryan Rakib

43,578 views • 23 days ago

This is a big update! visionOS 2.4 Beta is now available and I’m genuinely excited! The public release hits in April, but here’s the rundown of what’s available in visionOS 2.4 Beta today: • Apple Intelligence is coming to Vision Pro! All those rumors that said the first model wouldn’t get it. Dead wrong. We’re getting Image Playground to whip up fun images, Genmoji for custom emojis, and my personal favorite, Writing Tools. This is just the start of Apple Intelligence on Vision Pro and I’m excited to see where it takes us. • Guest User feature! Hand your Vision Pro to someone, and your nearby iPhone or iPad pings with an 'Allow Guest User' option. You pick their apps from your device, kick off View Mirroring with AirPlay to see what they’re seeing, and guide them through the experience. It’s clean, easy, and something many of us have been asking for. • A new Spatial Gallery app! Apple’s curating a stunning lineup of spatial photos, videos, and panoramas from artists, filmmakers, and brands like Cirque du Soleil and Porsche. Can’t wait to dive into that. • A new Vision Pro app for iPhone! Browse and queue up apps or games to download, discover spatial content from Apple TV and Spatial Gallery, and grab handy tips—all from your iPhone. It’ll roll out with iOS 18.4 wherever Vision Pro’s sold. I think it’ll be super useful. visionOS 2.4 is a big step up and it’s another strong signal that we have a lot to look forward to with spatial computing from Apple. We are just getting started.

This is a big update! visionOS 2.4 Beta is now available and I’m genuinely excited! The public release hits in April, but here’s the rundown of what’s available in visionOS 2.4 Beta today: • Apple Intelligence is coming to Vision Pro! All those rumors that said the first model wouldn’t get it. Dead wrong. We’re getting Image Playground to whip up fun images, Genmoji for custom emojis, and my personal favorite, Writing Tools. This is just the start of Apple Intelligence on Vision Pro and I’m excited to see where it takes us. • Guest User feature! Hand your Vision Pro to someone, and your nearby iPhone or iPad pings with an 'Allow Guest User' option. You pick their apps from your device, kick off View Mirroring with AirPlay to see what they’re seeing, and guide them through the experience. It’s clean, easy, and something many of us have been asking for. • A new Spatial Gallery app! Apple’s curating a stunning lineup of spatial photos, videos, and panoramas from artists, filmmakers, and brands like Cirque du Soleil and Porsche. Can’t wait to dive into that. • A new Vision Pro app for iPhone! Browse and queue up apps or games to download, discover spatial content from Apple TV and Spatial Gallery, and grab handy tips—all from your iPhone. It’ll roll out with iOS 18.4 wherever Vision Pro’s sold. I think it’ll be super useful. visionOS 2.4 is a big step up and it’s another strong signal that we have a lot to look forward to with spatial computing from Apple. We are just getting started.

Justin Ryan ᯅ

83,414 views • 1 year ago

We might've just cracked one of crypto's biggest UX problems. Introducing the Agentic Onramp/Offramp by Basemate. Onramp or offramp straight from your Base Account with Apple Pay in ~20 seconds — right inside the chat you're already in. iMessage. WhatsApp. Telegram. Base App. No new app to install. Powered by Coinbase Developer Platform🛡️ and Apple Basemate got a number.

We might've just cracked one of crypto's biggest UX problems. Introducing the Agentic Onramp/Offramp by Basemate. Onramp or offramp straight from your Base Account with Apple Pay in ~20 seconds — right inside the chat you're already in. iMessage. WhatsApp. Telegram. Base App. No new app to install. Powered by Coinbase Developer Platform🛡️ and Apple Basemate got a number.

Mateo

12,813 views • 2 months ago