Unit 1: How a Mac protects itself · Lesson 5 of 5 · 20 min
Case file: a zero-day in the system loader
Even the best protections have bugs. See how one exploited flaw becomes a fleet question you can answer in minutes.
case file
Apple dyld zero-day exploited against targeted individuals
Apple · 2026
In February 2026 Apple fixed CVE-2026-20700, a memory corruption flaw in dyld, across iOS, macOS, iPadOS, tvOS, watchOS and visionOS, saying it may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 26. Google's Threat Analysis Group reported it. Apple linked it to two WebKit and ANGLE flaws fixed in December 2025 from the same report.
What went wrong
Exploit chain combining browser-engine and system-loader bugs on devices that had not moved to patched releases.
What would have stopped it
- Enforce iOS and macOS update deadlines through MDM (for example declarative software update enforcement)
- Enable Lockdown Mode for high-risk users
- Keep Background Security Improvements and Rapid Security Responses enabled where offered
What defenders could have seen
- MDM inventory showing devices below iOS 26.3, iOS 18.7.5 or macOS 26.3
- Apple threat notifications to users
- Unexpected Safari or WebKit crashes on high-risk devices
mission
- You are
- You are the IT security lead at Lumen Studio.
- Situation
- A news alert says Apple patched an exploited dyld bug in macOS 26.3. Your MDM can export the version of every Mac.
- Goal
- Find which Macs are still below the fixed version and plan the update.
- Hand in
- A list of vulnerable Macs and an update deadline.
Sort by version
Open the inventory in the lab and sort the macOS column. Versions sort as numbers, so 26.0.1 comes before 26.1.
you should see Three Macs sit below 26.3.
Check who they belong to
Look at the user and last check-in for each one. A Mac that has not checked in for weeks may be lost, broken or switched off, and it will not update itself.
you should see One of them last checked in on 14 August.
Separate Intel and Apple silicon
Filter for Intel. These Macs cannot install Golden Gate, but Tahoe 26.7 carries the fix. Your target is the latest release each Mac can run, not the newest number.
you should see Three Intel Macs, all on 26.7.
Set the deadline
Use a Declarative Device Management update declaration with a target version and a date. The Mac warns the user, then installs at the deadline.
you should see A deadline within days for an exploited bug, weeks for routine updates.
defender tip Exploited bugs are patched in hours to days by Apple. Your patch window decides how long you stay exposed.
What a defender takes away
- 1Protections have bugs; updates fix the ones attackers already use.
- 2Know your fleet's versions before the news breaks.
- 3Enforce deadlines with MDM instead of reminding people.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.