[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVrfb637a-wNEOED83d3yHRqfQSJsVBuX2i5NKTMiKGw":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"d8e13c76-8e55-4858-9f75-6aa07ecac8e1","Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys","binance-warns-iphone-users-of-major-ios-flaw-that-may-expose-crypto-wallet-priva-3f4627","Binance has warned iPhone users about worse_query, an iOS flaw that could let malicious apps read files belonging to other apps. In its November 10 warning, the exchange named iOS 26.7.1, 27.0.1, and 27.2 as affected, saying seed phrases, private keys, and login details could be exposed. The company said this is an operating system […] The post Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys appeared first on Cyber Security News.","Binance has alerted iPhone users to a critical iOS flaw named 'worse_query' that allows malicious apps to access sensitive data from other applications. This vulnerability, affecting iOS versions 26.7.1, 27.0.1, and 27.2, could expose cryptocurrency wallet seed phrases, private keys, and login credentials. While the researcher describes it as a proof-of-concept, security experts warn that untrusted IPA packages could exploit this to steal wallet recovery phrases and keystore data.","Binance warns iPhone users of iOS flaw worse_query exposing crypto wallet data.","https:\u002F\u002Fcybersecuritynews.com\u002Fios-flaw-expose-crypto-wallet\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FiOS-crypto-wallet-vulnerability.webp","2026-11-10T11:40:16+00:00","2026-11-10T12:00:30.262862+00:00",8,[17,20],{"name":18,"type":19},"Binance","vendor",{"name":21,"type":22},"iOS","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":44,"vendors":121},[45,66,92],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[50,58],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":67,"name":68,"problem":69,"products":70},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":88,"product_name":89,"url":90,"description":91},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":93,"name":94,"problem":95,"products":96},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[122],{"slug":123,"name":124,"logo_path":125,"roles":126},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[127],"affected",{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"critical-ios-flaw-exposes-crypto-wallet-keys-on-unpatched-iphones","Critical iOS Flaw Exposes Crypto Wallet Keys on Unpatched iPhones","A critical iOS vulnerability dubbed 'worse_query' allows malicious applications to read sensitive data — including cryptocurrency seed phrases, private keys, and login credentials — belonging to other apps on the same device. The flaw affects multiple iOS versions and can be exploited via untrusted IPA packages, meaning users who sideload apps from unofficial sources face the greatest risk. This matters enormously in the crypto space because exposed private keys or seed phrases result in irreversible financial loss with no recourse. The incident highlights how unpatched mobile operating systems combined with low security awareness around app sourcing create a dangerous attack surface for high-value digital assets.",[133,134,135,136,137,138,139],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32",{"GDPR Article 32":141,"NIST SP 800-53 SI-2: Flaw Remediation":142,"OWASP A06:2021 Vulnerable and Outdated Components":143,"CIS Control 7: Continuous Vulnerability Management":144,"CIS Control 14: Security Awareness and Skills Training":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"If personal data or credentials stored on iOS devices are exposed through this flaw, organisations have an obligation under Article 32 to implement appropriate technical measures — including timely patching — to ensure ongoing confidentiality of personal data.","SI-2 requires organisations to identify, report, and correct information system flaws promptly — directly applicable here where a known iOS vulnerability must be remediated across all user devices handling sensitive cryptographic material.","The unpatched iOS versions represent an outdated, vulnerable component in the software stack; this OWASP category highlights exactly this risk and advocates for maintaining up-to-date platforms to prevent exploitation.","The 'worse_query' flaw affects specific, identifiable iOS versions; continuous vulnerability scanning and a defined patching deadline would ensure affected devices are identified and updated before exploitation occurs.","Users sideloading untrusted IPA packages is a primary exploitation vector; structured security awareness training on mobile app sourcing risks would directly reduce the likelihood of users inadvertently installing malicious apps.","This control mandates timely identification and remediation of technical vulnerabilities in systems, which would require organisations to track the 'worse_query' flaw and enforce patching on mobile devices accessing sensitive data.","The vulnerability exposes credentials and private keys stored on-device, undermining authentication integrity; this framework function calls for protecting sensitive authentication material, which includes ensuring the underlying OS cannot be exploited to extract it."]