Reported by 2 outlets

Timeline

1. original reporting

   Apple Private Cloud Compute Path Traversal Lets Attackers Write Files as Root During Boot

   gbhackers.com · 65d ago · August 10th, 2026

   CVE-2026-20685 (CVSS 6.5) is a path traversal in Apple's Private Cloud Compute infrastructure that lets a privileged network attacker write attacker-controlled files as root while a PCC node boots — before the hardened runtime starts. Researcher Drinor Selmanaj found darwin-init's extraction routine trusts only the first four bytes of an artifact, so a crafted archive escapes its extraction directory and can, for example, rewrite the splunkloggingd telemetry-forwarder config to redirect request metadata (token counts, timing, workload identifiers) to an attacker endpoint. The research also surfaced an attestation blind spot: compromised and clean boot images produce identical software-attestation fields. Fixed in PCC Release 5E290.3 and later; Apple awarded a $150,000 bounty. Deploy the release and restrict provisioning-path network access.

2. update from cyberpress.org

   Apple Private Cloud Compute Flaw Lets Attackers Write Files as Root

   cyberpress.org · 64d ago · August 10th, 2026

   A critical path traversal vulnerability in Apple’s Private Cloud Compute (PCC) , the server-side infrastructure powering Apple Intelligence. Tracked as CVE-2026-20685, the flaw earned a $150,000 bounty under the Apple Security Bounty program and was patched in PCC releases 5E290.3 and later. PCC handles Apple Intelligence requests that are too complex for on-device processing, promising iPhone-level privacy in the cloud through three guarantees. Apple Private Cloud Compute Flaw Statelessness (no data is retained across sessions), cryptographic attestation (devices verify that nodes run only Apple-published software), and sealed observability (only pre-approved telemetry leaves a node). The vulnerability struck at the boot process itself before these protections fully engage. The flaw lives in darwin-init, the root-privileged PID 1 process that provisions PCC nodes at boot by downloading and installing signed software bundles called cryptexes. When darwin-init encounters an archive that doesn’t match known magic bytes (AEA1 for Apple Encrypted Archive, AA01 for Apple Archive), it falls back to a generic extract(to:) function. PCC node boots (Source: sentry) Critically, that function takes filenames directly from the archive entries and appends them to the output path without sanitization, and none of libarchive’s security flags were enabled to block traversal. Because tar archives’ identifying signature sits at byte offset 257 beyond the four-byte check, a malicious tar file b

3. update from gbhackers.com

   Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root

   gbhackers.com · 64d ago · August 10th, 2026

   This flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an […] The post Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .