A MacSec Labs security research writeup. Responsibly disclosed to Apple, awarded an Apple Security Bounty, and fixed in macOS 26.4 as CVE-2026-20695.

Overview Calendar invites are one of the most trusted objects in a modern operating system. We subscribe to team calendars, add conference feeds, and click

Abusing legitimate machine learning infrastructure for payload delivery, in-memory staging, and EDR evasion on Windows 10/11. Introduction Every red team operator knows the

Overview Over 90% of Fortune 500 companies run Red Hat Enterprise Linux in production. Database backends, identity infrastructure, CI/CD pipelines, internal APIs. When the

Every modern Apple Silicon Mac ships with a hypervisor built into the operating system. Virtualization.framework the same backend behind Xcode, UTM, Docker Desktop, and