Apple Quietly Fixes iCloud Private Relay Vulnerability in iOS 26.6.1
The problem could leak your device’s IP address, even when the paid iCloud Plus feature was enabled.
Apple's iCloud Private Relay feature has been restored to its private status following a fix in iOS 26.6.1 that resolved a vulnerability. This paid feature, exclusive to iCloud Plus subscribers, routes web traffic through proxy servers to conceal a user's IP address and location. However, a vulnerability was discovered which could still expose the IP address under certain conditions.
Researchers Talal Haj Bakry and Tommy Mysk identified the issue, creating a webpage to test if devices were vulnerable. The vulnerability was patched in iOS 26.6.1, as evidenced by the leaks.psyop.app webpage reporting masked IP addresses instead of actual ones when iCloud Private Relay was enabled. Apple's swift response to the vulnerability, which Mysk noted as unlikely given Apple's typical response time, led to a lawsuit from Clarkson Law Firm, the firm behind a $250 million settlement with Apple over Apple Intelligence advertising.
Written by urgent.news from CNET's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
