{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "apple-attacked-bug-feb-2026",
  "url": "https://patchgap.ai/incidents/apple-attacked-bug-feb-2026/",
  "path": "/incidents/apple-attacked-bug-feb-2026/",
  "json_url": "https://patchgap.ai/incidents/apple-attacked-bug-feb-2026.json",
  "title": "Mac and iPhone: a core system bug was used in targeted attacks",
  "category": "mac",
  "platforms": [
   "macos",
   "ios"
  ],
  "products": [
   "macos",
   "iphone-ios"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "Apple says it may have been used in an extremely sophisticated attack against specific people. CISA lists it as used in real attacks (added Feb 12, 2026).",
  "exploited_source_url": "https://support.apple.com/en-us/126348",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-02-11",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-20700"
  ],
  "summary": "A bug in a core part of Apple's systems let attackers who already had a foothold run their own code. Apple says it was used against specific people. Apple fixed it in macOS Tahoe 26.3 and iOS 26.3.",
  "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.3 or your iPhone runs iOS 26 older than 26.3.",
  "action": "Update macOS and iPhone (26.3 or newer)",
  "affected": [
   {
    "product": "macos",
    "product_name": "macOS",
    "platform": "macos",
    "affected_versions": "macOS Tahoe before 26.3",
    "fixed_version": "26.3 (Tahoe)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/126348"
    ],
    "check": {
     "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
     "command": "sw_vers -productVersion",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   },
   {
    "product": "iphone-ios",
    "product_name": "iPhone and iPad (iOS)",
    "platform": "ios",
    "affected_versions": "iOS and iPadOS 26 before 26.3",
    "fixed_version": "iOS 26.3",
    "fixed_min": "26.3",
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/126346"
    ],
    "check": {
     "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://support.apple.com/en-us/100100"
   }
  ],
  "fix_steps": [
   "Click the Apple menu > System Settings > General > Software Update.",
   "Install the update it offers.",
   "Restart your Mac when asked.",
   "On iPhone or iPad: Settings > General > Software Update."
  ],
  "official_patch_links": [
   {
    "label": "Apple: update macOS on your Mac",
    "url": "https://support.apple.com/en-us/108382"
   },
   {
    "label": "Apple: update your iPhone or iPad",
    "url": "https://support.apple.com/en-us/100100"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://support.apple.com/en-us/126348",
    "title": "Apple: About the security content of macOS Tahoe 26.3",
    "date": "2026-02-11",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/126346",
    "title": "Apple: About the security content of iOS 26.3 and iPadOS 26.3",
    "date": "2026-02-11",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-20700 (added 2026-02-12)",
    "date": "2026-02-12",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20700",
    "title": "NVD: CVE-2026-20700",
    "date": "2026-02-11",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}