CISA Adds CVE-2024-27834 to KEV After Sekoia Reports PAC Bypass in Active Safari Campaigns

The entry follows a Sekoia report describing three delivery vectors—compromised sites, spoofed domains, and a Plerdy supply-chain compromise—that chain the medium-severity PAC bypass with a separate WebKit RCE to drop a cookie-harvesting payload. Technical details in the Sekoia post list device profiling and JavaScript execution but do not include public samples, YARA rules, or network indicators that would allow independent verification of the claimed zero-click chain.

The original Hacker News coverage repeats CVE-2025-43529 twice and places patching deadlines in 2026, both inconsistent with Apple’s May 2024 advisories and the actual CVE record. These errors obscure the timeline: the flaw was mitigated in iOS 17.5 / macOS 14.5, yet CISA still records ongoing use against unpatched systems more than two years later.

Procurement and incident records show repeated Russian-linked reuse of WebKit PAC bypasses after public Pwn2Own demonstrations; however, no public technical attribution from CISA or Apple links the current activity to APT29 beyond Sekoia’s moderate-confidence assessment. The absence of shared IOCs leaves open the possibility of copycat or criminal reuse.

Federal agencies must remediate by 18 November 2026. Expect additional in-the-wild chains that pair the same PAC bypass with newer WebKit RCEs once the current patch window closes.