From Newsgroup: comp.sys.mac.system

Yet another Apple zero-day CVE-2026-86950 already exploited in the wild.
<https://support.apple.com/en-us/149226>

Given Apple never finds their zero-day bugs, by definition, Meta Security
found them for Apple, and, it's been exploited in the wild before being reported, so Apple's patches are always evidence that Apple's QA sucks.
<https://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/>

Nobody has more exploited zero-days than Apple, showing yet again:
a. Apple marketing is brilliant
b. While Apple's QA sucks
<https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed/>

<https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-patches-coregraphics-zero-day-sophisticated-iphone-attacks>
The vulnerability, tracked as CVE-2026-86950, affects CoreGraphics,
an Apple framework responsible for drawing and processing graphics
across its operating systems.

The vulnerability arrives only weeks after Apple was informed of yet
another untested dangerous flaw in its image-processing technology.
<https://cybernews.com/security/apple-coregraphics-zero-day-exploit-patch/>

That earlier vulnerability, CVE-2026-65346, affected Apple's ImageIO
framework which also allowed almost complete access to the system.
<https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks>

Unlike the newly disclosed CoreGraphics vulnerability, Apple did not report CVE-2026-65346 as being exploited in the wild, thank God.

Apple patched the flaw on Sept. 28 in iOS 26.7.1 and iPadOS 26.7.1. The
updates are available for iPhone 11 and later, along with supported iPad
Pro, iPad Air, iPad and iPad mini models.

The same CoreGraphics vulnerability was also patched in macOS Tahoe 26.7.1
and macOS Sequoia 15.8.1.

Apple's advisory specifically refers to attacks against devices running versions of iOS before iOS 27. The company has not said which exact
versions were compromised.

Apple currently lists iOS and iPadOS 27.0.1 and macOS 27.0.1 as its latest operating-system releases for compatible hardware.

Essentially, Apple says to throw your Apple product over the next bridge if
you can't install those latest operating systems since Apple has never
fully patched any older operating system in the history of the company. <https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/>
<https://screenrant.com/apple-product-security-update-lifespan/> <https://hothardware.com/news/apple-admits-only-fully-patches-security-flaws-in-latest-os-releases>
--
Apple's marketing brilliance compensates for the worst QA in the industry.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

On Oct 10, 2026 at 7:23:15 PM MST, "Maria Sophia" wrote <11aerug$2bfg$1@nnrp.usenet.blueworldhosting.com>:

Yet another Apple zero-day CVE-2026-86950 already exploited in the wild.
<https://support.apple.com/en-us/149226>

Given Apple never finds their zero-day bugs, by definition, Meta Security found them for Apple, and, it's been exploited in the wild before being reported, so Apple's patches are always evidence that Apple's QA sucks.

Without a comparison to other similar companies your claim there is empty. It is not evidence of them having weaker QA.

If the question is about total standard bugs and malware, Android sees higher numbers. But if the question is about high-stakes, actively exploited zero-day exploits, iOS consistently records a higher number of discovered instances due to intense targeting by advanced espionage and spyware operations.

https://silentbreach.com/blog/cybersecurity-matchup-apple-vs-android https://www.bleepingcomputer.com/news/security/2021-mobile-security-android-more-vulnerabilities-ios-more-zero-days

That does not suggest they have weaker QA.

Your claim is contrary to evidence.

...
--
It's impossible for someone who is at war with themselves to be at peace with you.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

On 2026-10-11 15:17:10 +0000, Brock McNuggets said:

On Oct 10, 2026 at 7:23:15 PM MST, "Maria Sophia" wrote <11aerug$2bfg$1@nnrp.usenet.blueworldhosting.com>:

Yet another Apple zero-day CVE-2026-86950 already exploited in the wild.
<https://support.apple.com/en-us/149226>

Given Apple never finds their zero-day bugs, by definition, Meta Security
found them for Apple, and, it's been exploited in the wild before being
reported, so Apple's patches are always evidence that Apple's QA sucks.

Without a comparison to other similar companies your claim there is empty. It is not evidence of them having weaker QA.

If the question is about total standard bugs and malware, Android sees higher numbers. But if the question is about high-stakes, actively exploited zero-day
exploits, iOS consistently records a higher number of discovered instances

"discovered" by "researchers", often the same ones trying to sell you
their anti-malware apps. Very very few of those so-called "discoveries"
are ever actually seen on the public's devices.

due to intense targeting by advanced espionage and spyware operations.

https://silentbreach.com/blog/cybersecurity-matchup-apple-vs-android https://www.bleepingcomputer.com/news/security/2021-mobile-security-android-more-vulnerabilities-ios-more-zero-days

That does not suggest they have weaker QA.

Your claim is contrary to evidence.

...

--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

On Oct 11, 2026 at 2:05:32 PM MST, "Your Name" wrote <11agtmr$30r69$1@dont-email.me>:

On 2026-10-11 15:17:10 +0000, Brock McNuggets said:

On Oct 10, 2026 at 7:23:15 PM MST, "Maria Sophia" wrote
<11aerug$2bfg$1@nnrp.usenet.blueworldhosting.com>:

Yet another Apple zero-day CVE-2026-86950 already exploited in the wild. >>> <https://support.apple.com/en-us/149226>

Given Apple never finds their zero-day bugs, by definition, Meta Security >>> found them for Apple, and, it's been exploited in the wild before being
reported, so Apple's patches are always evidence that Apple's QA sucks.

Without a comparison to other similar companies your claim there is empty. It
is not evidence of them having weaker QA.

If the question is about total standard bugs and malware, Android sees higher
numbers. But if the question is about high-stakes, actively exploited zero-day
exploits, iOS consistently records a higher number of discovered instances

"discovered" by "researchers", often the same ones trying to sell you
their anti-malware apps. Very very few of those so-called "discoveries"
are ever actually seen on the public's devices.

Perhaps... but there are exploits found. And fixed. True of any complex code.

due to intense targeting by advanced espionage and spyware operations.

https://silentbreach.com/blog/cybersecurity-matchup-apple-vs-android
https://www.bleepingcomputer.com/news/security/2021-mobile-security-android-more-vulnerabilities-ios-more-zero-days


That does not suggest they have weaker QA.

Your claim is contrary to evidence.

...

--
It's impossible for someone who is at war with themselves to be at peace with you.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Your Name wrote:

If the question is about total standard bugs and malware, Android sees higher
numbers. But if the question is about high-stakes, actively exploited zero-day
exploits, iOS consistently records a higher number of discovered instances

"discovered" by "researchers", often the same ones trying to sell you
their anti-malware apps. Very very few of those so-called "discoveries"
are ever actually seen on the public's devices.

This post below should be an "eye opener" on facts for Apple aficionados.

Since there seems to be some confusion, the main point is Apple's QA sucks. That's really the point. It's that simple. It's easy to prove.

I get it that most of you Apple nutjobs "think" Apple's QA is great.
I know why. It's because Apples MARKETING is brilliant.

You fall for every trick in the book.
One of those tricks is Apple 'says' they restrict you "for your safety".

Fine. It sounds good, right?
Apple devices can't do half of what all other devices can do, right?
*For your safety*

And yet, there is no added safety.
Apple devices are worse than other similar devices.

Why?
Back to the QA.

Apple doesn't have any QA.
In fact, arguably, Apple's QA is the worst in the business.

The facts prove it.

Note it's not me proving Apple's QA is the worst in the industry.
The facts prove it.

For example:
<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>

You lost all that functionality everyone else has, "for your safety".
And yet, you got no safety out of the deal.

So who got "something" by preventing Apple devices from doing stuff?

HINT: Look at Apple's profits.
--
Sometimes we have to reassess that what we had "known" all along, is wrong.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

On Oct 12, 2026 at 12:38:01 AM MST, "Maria Sophia" wrote <11ai2ol$fj5$1@nnrp.usenet.blueworldhosting.com>:

Your Name wrote:

If the question is about total standard bugs and malware, Android sees higher
numbers. But if the question is about high-stakes, actively exploited zero-day
exploits, iOS consistently records a higher number of discovered instances >>

"discovered" by "researchers", often the same ones trying to sell you
their anti-malware apps. Very very few of those so-called "discoveries"
are ever actually seen on the public's devices.

This post below should be an "eye opener" on facts for Apple aficionados.

Since there seems to be some confusion, the main point is Apple's QA sucks. That's really the point. It's that simple. It's easy to prove.

Then why did you not when you first posted?

I get it that most of you Apple nutjobs "think" Apple's QA is great.
I know why. It's because Apples MARKETING is brilliant.

Where do you see others making any comparison?

You fall for every trick in the book.
One of those tricks is Apple 'says' they restrict you "for your safety".

You are much less likely to get malware on Apple products than on MS ones or Android. As you have been shown. With evidence.

Fine. It sounds good, right?
Apple devices can't do half of what all other devices can do, right?

Incorrect.

*For your safety*

And yet, there is no added safety.

Evidence shows otherwise.

Apple devices are worse than other similar devices.

Why?
Back to the QA.

Apple doesn't have any QA.

This is contrary to evidence.

In fact, arguably, Apple's QA is the worst in the business.

If it is worse then they have it. You contradict yourself. And did not back that it is worse.

The facts prove it.

You have not backed anything.

Note it's not me proving Apple's QA is the worst in the industry.
The facts prove it.

Yet you have not shown this.

For example:
<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>

You lost all that functionality everyone else has, "for your safety".
And yet, you got no safety out of the deal.

You have yet to show this. And the evidence shows otherwise.

So who got "something" by preventing Apple devices from doing stuff?

HINT: Look at Apple's profits.

Ah, you are jealous. Got it.
--
It's impossible for someone who is at war with themselves to be at peace with you.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

On 10/11/2026 11:17 AM, Brock McNuggets wrote:

On Oct 10, 2026 at 7:23:15 PM MST, "Maria Sophia" wrote <11aerug$2bfg$1@nnrp.usenet.blueworldhosting.com>:

Yet another Apple zero-day CVE-2026-86950 already exploited in the wild.
<https://support.apple.com/en-us/149226>

Given Apple never finds their zero-day bugs, by definition, Meta Security
found them for Apple, and, it's been exploited in the wild before being
reported, so Apple's patches are always evidence that Apple's QA sucks.

Without a comparison to other similar companies your claim there is empty. It is not evidence of them having weaker QA.

If the question is about total standard bugs and malware, Android sees higher numbers. But if the question is about high-stakes, actively exploited zero-day
exploits, iOS consistently records a higher number of discovered instances due
to intense targeting by advanced espionage and spyware operations.

https://silentbreach.com/blog/cybersecurity-matchup-apple-vs-android https://www.bleepingcomputer.com/news/security/2021-mobile-security-android-more-vulnerabilities-ios-more-zero-days

That does not suggest they have weaker QA.

Your claim is contrary to evidence.

Microsoft had its time with this, Windows 2000 and XP, and earlier
versions in various respects.
--
Joel W. Crump
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Joel W. Crump wrote:

Your claim is contrary to evidence.

Microsoft had its time with this, Windows 2000 and XP, and earlier
versions in various respects.

The point of these threads is to get people to "think" scientifically.

As noted, all operating systems go through a maturity phase if they last
long enough, where most of the existing operating systems are mature now.

The main point about Apple operating systems is that Apple (brilliantly)
claims that the software is locked down *for your safety* but it's not.

It's locked down *for Apple's profits*, and for no other reason.
The proof is that Apple software is no safer than anyone else's software.

Now, Brock (Snit) knows so little about software that he thinks the only
metric for safety is "malware", which, while one metric, is not all of it.

Zero-day bugs matter too, and Apple software has a very high number of 'em.
<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>
Those are *exploited* zero-day bugs, mind you, which is its own metric.

I realize a lot of people "think" that Apple software must be secure, but
the evidence shows Apple's QA is atrocious, where that evidence abounds.

Take the case of small kids finding huge holes in the FaceTime software.
And take Project Zero proving huge chunks of iOS code never tested.
<https://cyberscoop.com/iphone-hack-google-project-zero/>

The main point is Apple claims we lost tons of functionality, *for safety*.
And yet, that lost functionality didn't give any of us an ounce of safety.

Why did Apple remove all that functionality everyone else has then?
Hmmmm... maybe for profits alone...
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Maria Sophia <mariasophia@comprehension.com> wrote:

Note it's not me proving Apple's QA is the worst in the industry.
The facts prove it.

For example:
<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>

Back to your old tricks again.

You've been told time and again that CISA KEV does not and cannot be used
to prove anything one way or another. It represents less than 5% of the
threat landscape.

As per usual you ignore uncomfortable truths which contradict your dogma.


--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Chris wrote:

You've been told time and again that CISA KEV does not and cannot be used
to prove anything one way or another. It represents less than 5% of the threat landscape.

Look at what I said, Chris. And yes, we discussed this.
It's a list of important exploited zero-day vulnerabilities.

You're about the only one on the Apple newsgroup who understood that.
Since you are likely the only one who understands anything, let me ask...

Q: If the iOS operating system is so safe, why are there so many of them?
A: ?

HINT: iOS is not any safer than any other operating system and anyone who believes it is, doesn't know about key zero-day exploited security holes.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Maria Sophia <mariasophia@comprehension.com> wrote:

Chris wrote:

Maria Sophia <mariasophia@comprehension.com> wrote:

Note it's not me proving Apple's QA is the worst in the industry.
The facts prove it.

For example:
<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>

You've been told time and again that CISA KEV does not and cannot be used
to prove anything one way or another. It represents less than 5% of the
threat landscape.

Look at what I said, Chris.

Snipped context so that we can see exactly what you said.

And yes, we discussed this.
It's a list of important exploited zero-day vulnerabilities.

You're about the only one on the Apple newsgroup who understood that.
Since you are likely the only one who understands anything, let me ask...

Q: If the iOS operating system is so safe, why are there so many of them?
A: ?

HINT: iOS is not any safer than any other operating system and anyone who believes it is, doesn't know about key zero-day exploited security holes.

I refer to my previous point. You can't objectively say that.

The above is purely your opinion. It always has been and always will be
unless you do the hard graft of doing an actual analysis.



--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: comp.sys.mac.system

Chris wrote:

Q: If the iOS operating system is so safe, why are there so many of them?
A: ?

HINT: iOS is not any safer than any other operating system and anyone who
believes it is, doesn't know about key zero-day exploited security holes.

I refer to my previous point. You can't objectively say that.

The above is purely your opinion. It always has been and always will be unless you do the hard graft of doing an actual analysis.

Chris,

You know I published batch scripts so that anyone could disassemble the
CISA database to compare the astoundingly huge number of iOS zero-day important exploited vulnerabilities, where nobody could dispute that.

My main question for the Apple religious nutcases to ponder, is this one:

Q: If iOS is secure, why are there so many critical exploited 0-day holes?
A: ?

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: kev.bat
:: Usage: C:\> kev.bat
:: Extensible Windows batch/powershell script to parse csv/json CISA KEV db
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: kev.ps1 must reside in same folder as kev.bat
:: kev.bat calls kev.ps1 using powershell with execution policy bypass
:: Output pauses so user can read results before window closes
:: The goal is to determine if Apple is telling the truth when Apple "says"
:: they locked iOS users into a walled prison garden "for their own safety".
:: As one step of that goal, the question to answer is simply thus:
:: Q: What are cumulative exploits between iPhone/iPad & Android flagships?
:: <https://github.com/cisagov/kev-data>
:: <https://www.cisa.gov/known-exploited-vulnerabilities>
:: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>
:: Note this db is only about 6% of all known vulnerabilities!
:: <medium.com/@yotamperkal/cisa-kev-a-balanced-perspective-ff3856e69ba9>
:: That's because the KEV db only contains exploits meeting these criteria:
:: 1. The exploit has a valid CVE ID.
:: 2. There is reliable evidence of active exploitation.
:: 3. A clear remediation action is already available to the general public.
:: The KEV database is in three files:
:: a. CSV (Comma-Separated Values)
:: <github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities.csv>
:: b. JSON (JavaScript Object Notation)
:: <github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities.json>
:: c. JSON Schema (Defines the structure of the JSON data)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: REVISION HISTORY:
:: Version v1.0 20250929 (45L)
:: Invokes powershell to parse csv/json CISA database for iOS vs Android
:: Version 1.1 2025???? (??L)
:: TBD
:: Version 1.2 2025???? (??L)
:: TBD
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 72 char 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 12
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

@echo off
set "PS_SCRIPT=kev.ps1" REM iOS vs Android known patched exploits
powershell -ExecutionPolicy Bypass -File "%~dp0%PS_SCRIPT%"
pause
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: End of kev.bat
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

###############################################################################
## kev.ps1
## An Extensible cross-platform batch/powershell script to parse CISA KEV db
## Analyzes the CISA Known Exploited Vulnerabilities (KEV) database
## to compare iOS and Android-related security threats.
## a. Downloads lates KEV CSV or uses a local copy of the KEV CSV file
## b. Filters out irrelevant entries (e.g., smart appliances, printers)
## c. Uses keywords & vendor-product logic for platform-specific exploits
## d. Identifies shared vulnerabilities affecting both ecosystems
## e. Logs results to timestamped files in a clean ./logs directory
## f. Outputs Apple iOS vs Android exploit summaries to console & log files
## All logs are saved in the ./logs directory:
## A. ios_matches_YYYYMMDD_HHMMSS.log
## B. android_matches_YYYYMMDD_HHMMSS.log
## C. shared_matches_YYYYMMDD_HHMMSS.log
## D. kev_output_YYYYMMDD_HHMMSS.log (summary)
## Note the CISA KEV db lists only about 6% of all known vulnerabilities!
## <medium.com/@yotamperkal/cisa-kev-a-balanced-perspective-ff3856e69ba9>
## That's because the KEV db only contains exploits meeting these criteria:
## 1. The exploit has a valid CVE ID.
## 2. There is reliable evidence of active exploitation.
## 3. A clear remediation action is already available to the general public.
###############################################################################
## Windows Usage: C:\> kev.bat
## Where kev.bat is the following three lines of code:
## set "PS_SCRIPT=kev.ps1" REM iOS vs Android known patched exploits
## powershell -ExecutionPolicy Bypass -File "%~dp0%PS_SCRIPT%"
## pause
## Linux/macOS Usage: $ pwsh ./kev.ps1
## Requires PowerShell Core (pwsh) <https://github.com/PowerShell/PowerShell>
## Make sure execution policy allows script execution:
## $ pwsh -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass"
###############################################################################
## Version 1.0 20250829 (41L)
## Extensible Windows batch/powershell script to parse csv/json CISA KEV db
## Uses powershell to parse csv/json CISA database for iOS vs Android
## Added comment discipline rules for ASCII-only and no oxford comma
## CSV downloaded from GitHub mirror of CISA KEV database
## Keyword logic uses lowercase match on vendor, product, and vuln name
## Matching uses wildcard logic with simple substring detection
## Results printed to console with Write-Host
## Script can be extended to log output or refine keyword logic
## Verson 1.1 20250929 (56L)
## Adds time-stamped output file to current directory
## Uses Get-Date with custom format for filename
## Output file includes iOS and Android known exploit counts
## Output file UTF8 encoding for platform/editor compatibility
## Version 1.2 20250929 (68L)
## Expands keyword logic for iOS and Android ecosystems
## Adds ipad, watchos, macos, pixel, samsung, qualcomm, mediatek
## Improves platform distinction across shared components like WebKit
## Android common vendors & chipsets: pixel, samsung, qualcomm, mediatek
## iOS platforms: ipad, ipados, watchos, macos
## Used Join-Path to make filespecs usable on Windows/Linux/macOS
## Version 1.3 20250929 (87L)
## Added an output log to a separate file of each match with its source line
## Modified filespecs to enable macOS/Linux PowerCore portability
## Version 1.4 20250929 (97L)
## Included CVE ID in logs (Adds traceability & audit value)
## Added platform detection (Join-Path & $PWD)
## Add toggle for local file (avoid unnecessary d/l when testing)
## Version 1.5 20250929 (108L)
## Add exclusion filtering logic (e.g., samsung TVs)
## Exclusion filtering removes Apple smart home devices.
## Version 1.6 20250929 (130L)
## Added shared-match detection to avoid double counting overlapping attack
## surfaces in platform-specific summaries
## Version 1.7 20250929 (141L)
## Added vendor-product dictionary-style mapping to excluse false positives
## like "Samsung tv" or "refrigerator" or "Apple tv" or "homepod"
## Version 1.8 20250929 (148L)
## Refined keyword logic for deeper iOS & Android exploit detection
## around shared components like WebKit & cryptographic modules
## Apple includes subsystems like secure enclave, coremedia & launchd
## Android includes cryptographic modules & shared components like
## keymaster, webkit & play services.
## Version 1.9 20250929 (163L)
## Moved all log files into ./logs directory to reduce clutter
## Added usage instructions for macOS/Linux (pwsh)
## Version 2.0 20250929 (207L)
## Added toggle to include/exclude macOS from iOS counts
## Fixed platform detection (Join-Path & $PWD) console output
## Version 2.1 20250929 (212L)
## Added output of the1 PowerShell version (in case of mismatches)
## Version 2.2 20250930 (219L)
## Added date in the console output
## Version 2.3 20250930 (228L)
## Removed false positives from desktop and server-side CVEs
## Added 'chromium' & 'mojo' to iOS & Android keyword lists
## Improved detection of shared browser & sandbox escape exploits
## Added exclusion for Fortinet, Cisco, Oracle & Adobe using keywords of
## fortinet, fortios, fortiproxy, cisco, oracle, adobe, jenkins, mozilla,
## nagios, redis, qnap, crushftp
## Version 2.4 20250930 (231L)
## Added the script version to the console output for auditing purposes
###############################################################################
# Define script version
$scriptVersion = "kev.ps1 version 2.4 20250930"
# Platform detection (v2.3)
$platform = $PSVersionTable.PSEdition
$version = $PSVersionTable.PSVersion
if ($platform -eq "Desktop") {
Write-Host "Running on platform: Windows PowerShell"
} elseif ($platform -eq "Core") {
if ($IsWindows) {
Write-Host "Running on platform: Windows (pwsh)"
} elseif ($IsLinux) {
Write-Host "Running on platform: Linux (pwsh)"
} elseif ($IsMacOS) {
Write-Host "Running on platform: macOS (pwsh)"
} else {
Write-Host "Running on platform: Unknown Core edition"
}
} else {
Write-Host "Running on platform: Unknown"
}
Write-Host "PowerShell version: $version"
# Download the KEV CSV from GitHub
$useLocalFile = $false # Set to $true for testing of existing downloads
$useLocalFile = $true # Set to $false to force download
$includeMacOS = $true # Set to $false to exclude macOS in iOS counts
$includeMacOS = $false # Set to $true to include macOS in iOS counts
if ($useLocalFile) {
$csvPath = Join-Path -Path $PWD -ChildPath "kev.csv"
Write-Host "Using local file: $csvPath"
} else {
$csvUrl = "https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.csv"
$csvPath = Join-Path -Path $PWD -ChildPath "kev.csv"
Invoke-WebRequest -Uri $csvUrl -OutFile $csvPath
Write-Host "Downloaded fresh file: $csvPath"
}
# Define keyword logic for iOS and Android
# iOS includes Apple platforms and WebKit-based browsers
$iosKeywords = @(
"apple", "ios", "ipados", "watchos", "webkit", "safari",
"secure enclave", "coregraphics", "coremedia", "corefoundation",
"springboard", "launchd", "sandbox", "chromium", "mojo"
)
if ($includeMacOS) {
$iosKeywords += "macos"
}
# Android includes Google platforms and common Android vendors
$androidKeywords = @(
"android", "google", "pixel", "samsung", "qualcomm", "mediatek",
"play services", "keymaster", "keystore", "secure element", "omapi",
"webkit", "chromium", "mojo"
)
# Initialize counters for each platform
$iosCount = 0
$androidCount = 0
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$logDir = Join-Path -Path "." -ChildPath "logs"
if (-not (Test-Path $logDir)) {
New-Item -ItemType Directory -Path $logDir | Out-Null
}
$iosLogPath = Join-Path -Path $logDir -ChildPath "ios_matches_$timestamp.log"
$androidLogPath = Join-Path -Path $logDir -ChildPath "android_matches_$timestamp.log"
$sharedLogPath = Join-Path -Path $logDir -ChildPath "shared_matches_$timestamp.log"
$outputFile = Join-Path -Path $logDir -ChildPath "kev_output_$timestamp.log"
# Parse KEV CSV and count keyword matches
$excludeKeywords = @(
"refrigerator", "tv", "washer", "dryer", "smart appliance", "iot", "industrial", "printer",
"apple tv", "homepod", "airtag", "fortinet", "fortios", "fortiproxy", "cisco",
"oracle", "adobe", "jenkins", "mozilla", "nagios", "redis", "qnap", "crushftp"
)
$vendorProductMap = @{
"samsung" = @("galaxy", "android", "mobile", "tablet")
"qualcomm" = @("snapdragon", "modem", "chipset")
"apple" = @("iphone", "ipad", "ios", "watchos", "macbook")
}
if ($includeMacOS) {
$vendorProductMap["apple"] += "macos"
}
Import-Csv $csvPath | ForEach-Object {
$text = ($_.vendorProject + " " + $_.product + " " + $_.vulnerabilityName).ToLower()
$vendor = $_.vendorProject.ToLower()
$product = $_.product.ToLower()
# Skip irrelevant matches
if ($excludeKeywords | Where-Object { $text -like "*$_*" }) {
return
}
# Skip mismatched vendor-product combos
if ($vendorProductMap.ContainsKey($vendor)) {
$validProducts = $vendorProductMap[$vendor]
if (-not ($validProducts | Where-Object { $product -like "*$_*" })) {
return
}
}
$logEntry = "$($_.cveID): $text"
$iosMatch = $iosKeywords | Where-Object { $text -like "*$_*" }
$androidMatch = $androidKeywords | Where-Object { $text -like "*$_*" }
if ($iosMatch -and $androidMatch) {
$iosCount++
$androidCount++
Add-Content -Path $iosLogPath -Value "$logEntry`n"
Add-Content -Path $androidLogPath -Value "$logEntry`n"
Add-Content -Path $sharedLogPath -Value "$logEntry`n"
} elseif ($iosMatch) {
$iosCount++
Add-Content -Path $iosLogPath -Value "$logEntry`n"
} elseif ($androidMatch) {
$androidCount++
Add-Content -Path $androidLogPath -Value "$logEntry`n"
}
}
# Output results to console
Write-Host "KEV vulnerability summary ($scriptVersion) for: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
Write-Host "Estimated Apple-iOS-related exploits: $iosCount"
Write-Host "Estimated Android-related exploits: $androidCount"
if (Test-Path $sharedLogPath) {
$sharedCount = (Get-Content $sharedLogPath | Measure-Object).Count
Write-Host "Estimated shared exploits: $sharedCount"
Add-Content -Path $sharedLogPath -Value "Shared iOS/Android vulnerabilities:`n"
Add-Content -Path $sharedLogPath -Value "`nTotal shared matches: $sharedCount"
} else {
Write-Host "Estimated shared exploits: 0"
}
# Create time-stamped output file in current directory
# $outputFile = "kev_output_$timestamp.log"
# Allow for macOS/Linux PowerShell Core portability (filespec syntax)
# Write results to file
@(
"KEV vulnerability summary $timestamp",
"Estimated Apple-iOS-related exploits: $iosCount",
"Estimated Android-related exploits: $androidCount"
) | Out-File -FilePath $outputFile -Encoding UTF8
# Append a summary line to each match log (v1.4)
Add-Content -Path $iosLogPath -Value "`nTotal iOS matches: $iosCount"
Add-Content -Path $androidLogPath -Value "`nTotal Android matches: $androidCount"
###############################################################################
## end of kev.ps1
###############################################################################
--
If iOS is secure, why are there so many important exploited zero-day holes?
--- Synchronet 3.21e-Win32 NewsLink 1.2