[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8ibzErS6RWuOEYP0z6JJ9Fwj32wv2fmHpwSnbQs4V5I":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"56bf85ca-f0cf-4090-94a1-965a7fcfaa54","Binance warns of iOS flaw that could leak crypto wallet secrets","binance-warns-of-ios-flaw-that-could-leak-crypto-wallet-secrets-9d3024","Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. [...]","Binance is alerting users to a vulnerability in specific iOS versions (26.7.1, 27.0.1, 27.2) that permits malicious third-party apps to access private files. This could expose sensitive data like cryptocurrency seed phrases and login credentials. A proof-of-concept exploit called WQ Files has been released, which uses the 'worse_query' technique to bypass sandbox restrictions without requiring a jailbreak. Apple has released security updates addressing multiple flaws, including one potentially related to this issue (CVE-2026-113963), though confirmation is pending.","Binance warns of iOS flaw allowing apps to read private files, risking crypto secrets.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbinance-warns-of-ios-flaw-that-could-leak-crypto-wallet-secrets\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F09\u002FBinance.jpg","2026-11-10T15:59:19+00:00","2026-11-10T16:00:21.931467+00:00",9,[17,20,22],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":19},"Binance",{"name":23,"type":24},"iOS","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"cve","CVE-2026-113963","Potentially related vulnerability fixed in Apple's security updates.",{"type":42,"value":54,"context":55},"WQ Files","Proof-of-concept exploit tool for the iOS vulnerability.",[18,21],{"controls":58,"vendors":135},[59,88,109],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[93,101],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":110,"name":111,"problem":112,"products":113},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":123,"product_name":124,"url":125,"description":126},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[136],{"slug":137,"name":18,"logo_path":138,"roles":139},"apple","\u002Fvendor-logos\u002Fapple.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"ios-sandbox-bypass-exposes-crypto-wallet-secrets-patch-now","iOS Sandbox Bypass Exposes Crypto Wallet Secrets — Patch Now","A vulnerability in specific iOS versions allows malicious third-party apps to escape their sandboxes and read private files belonging to other apps — without requiring a jailbreak. For cryptocurrency users, this is especially dangerous because sensitive data like seed phrases and login credentials stored locally on the device can be silently exfiltrated by a rogue app. The release of a working proof-of-concept exploit (WQ Files) dramatically lowers the bar for attackers, meaning exploitation is no longer theoretical. Apple has issued security updates that likely address this flaw, making prompt patching the single most important mitigation. This incident underscores the broader risk of storing highly sensitive secrets in app-local storage on shared mobile operating system environments.",[146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-28: Protection of Information at Rest","NIS2 Article 21(2)(e)","MITRE ATT&CK T1409: Collect Data from Local System",{"NIS2 Article 21(2)(e)":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"MITRE ATT&CK T1409: Collect Data from Local System":154,"CIS Control 7: Continuous Vulnerability Management (v8)":155,"NIST SP 800-53 SC-28: Protection of Information at Rest":156},"This point covers vulnerability handling and disclosure in the acquisition and maintenance of systems, directly applicable because timely vulnerability response to the iOS sandbox flaw is the core remediation action required.","SI-2 mandates identifying and correcting software flaws in a timely manner; had affected iOS devices been patched as soon as Apple released the update, this sandbox bypass vulnerability would have been eliminated.","The WQ Files proof-of-concept uses the 'worse_query' sandbox bypass specifically to access and collect private app files from the local device filesystem, matching this technique exactly.","CIS Control 7 requires organizations to track, remediate, and prioritize vulnerabilities on a continuous basis — applying Apple's patch promptly would directly close the sandbox escape used in this exploit.","SC-28 requires sensitive data stored on devices to be protected; seed phrases and credentials accessible to rogue apps indicate insufficient protection of data at rest within the mobile environment."]