6 minSociety
Apple Warns Users of Targeted Malware, Researchers Expose Airplane and AI Security Flaws
Apple has begun sending push notifications to users in 110 countries warning of potential targeted malware infections. Meanwhile, security researchers have revealed new vulnerabilities in Boeing 737 communications systems, Microsoft Copilot, and Comcast home routers.
Apple has started sending push notifications to users in 110 countries, warning them that they may have been targeted or already impacted by specific malware. The alerts, which appear as emails, standard system notifications, and messages inside the Settings application, mark a significant step in the company's efforts to protect users from sophisticated cyber threats. While Apple has not disclosed specific details about the threat detected, the notifications are part of a broader pattern of state-level surveillance and cyberattacks that have increasingly targeted political opponents, protesters, human rights lawyers, and journalists.
The timing of these warnings coincides with multiple iOS attacks released in the spring of 2026, though those attacks reportedly target much older versions of iOS and older hardware. Apple typically uses the crash reporting mechanism for system apps to track new attack trends, and the company has been proactive in alerting users when it detects unusual activity. However, the majority of users will likely never see such an alert, as malware with state-level capabilities like the Pegasus family is extremely expensive to develop and deploy. Despite this, commercial availability has made these tools accessible to some governments, who have used them against dissidents and other high-risk individuals.
For those who receive an alert, Apple recommends enabling Lockdown Mode, which adds extra protection to devices at the cost of decreased battery life and slower performance. Lockdown Mode disables custom fonts on web pages, accelerates JavaScript restrictions, limits message attachments over SMS and iMessage, and blocks other common paths used by malware to steal data. Android devices offer a similar feature since Android 15, though it is less comprehensive. While email and notifications can be spoofed as part of phishing attempts, Apple notes that to date, nothing can generate false alerts inside the Settings application, making these warnings particularly credible.
In a separate development, researchers at the Usenix 2026 conference presented an attack against the communications bus of a Boeing 737. The ARINC 429 bus, a communications architecture for planes similar to the CAN bus used in cars, was found to be vulnerable to data manipulation once an attacker gains access. The researchers discovered that one access port to the airplane communications system is easily reached from the outside of the plane, though only by airplane maintenance technicians. The paper represents over a decade of work by the team, culminating in an embedded device described as the size of a quarter that plugs into the communications port and provides remote access over WiFi.
Once connected to the ARINC bus, the researchers found that access is essentially unfettered. They described being able to reprogram the autopilot, feed the pilot displays false data, and modify temperature and weight data, which could lead to miscalculations in take-off speeds with catastrophic results. However, the researchers have been working with Boeing since 2020 to address the issues, and the practicality of the attack in the wild remains largely theoretical. The team has recommended removing the external ports in future aircraft and blocking access to them physically, such as with epoxy, in current designs.
Meanwhile, Microsoft Copilot has been tricked into executing hostile prompts without user intervention, a vulnerability exposed by researchers at Varonis who used Copilot itself to uncover the flaw. Copilot has guardrails intended to prevent the disclosure of private information, but the researchers were able to get the model to disclose the exact errors and restrictions that prevented running unauthorized queries. Eventually, Copilot admitted to an undocumented URL parameter, autorun=1, that would automatically execute a query. When Microsoft removed the parameter as part of its initial fix, several AI browser extensions failed, suggesting the parameter may have been in place to enable automation on behalf of the user without showing the actual prompts being run.
Prompts set to autorun were allowed to execute with no intervention, including prompts to disclose the contents of the user's inbox, stored information in the user's Copilot session, and any connected apps and services. The vulnerability highlights the ongoing challenges of securing AI systems that are increasingly integrated into daily workflows and enterprise environments.
Finally, Comcast is enabling WiFi Motion Detection on its fleet of home router and access point devices. The feature works by detecting changes in signal levels when people or pets move around, as they are essentially various sized bags of radio-blocking water that cause fluctuations in the signal levels of surrounding devices. Comcast says the feature is optional and opt-in, meaning it will not be turned on unless a customer enables it. However, the risks lie in the second-order aspects: how much data is collected, how it is stored, and what it exposes about a home. As home networks become more integrated with daily life, the privacy implications of such features will likely continue to be a topic of debate.
